3 ms·

Which boxes on this checklist are not components of browser security? I'm nothing like an expert on cybersecurity, but they generally seem relevant to me. Conv

Which boxes on this checklist are not components of browser security? I'm nothing like an expert on cybersecurity, but they generally seem relevant to me. Conversely, what boxes would you say are missing?

ryanlol 7y ago
My objection really has nothing to do with the specific boxes. This is just fundamentally the wrong approach, as is demonstrated by the fact that every browser except IE essentially got a perfect score except for telemetry. Do you see a site isolation checkbox there btw? Missing one of the most important exploit mitigation technologies for browsers today strongly suggests that whoever made this list was either incompetent or deliberately picking boxes that firefox ticks. I'd assume that instead of having actual browser security experts build this list they had some amateurs attempt to build a list of existing security "features" in browsers, which isn't a sane approach at all and is bound to get results like this. A good checklist would almost certainly have lots of boxes nobody ticks.
- jammygit 7y ago
  With telemetry, it’s by definition non-secure since it’s leaking your information by design
  - ryanlol 7y ago
    I'd argue that depends entirely on the contents of the telemetry, which don't appear to be a part of this assessment. Besides (since this isn't about defaults), if you're configuring your browser to disable telemetry couldn't you just as well configure your firewall to block it? Automatic updates also tend to leak information by design. But anyway, this has nothing to do with my larger point. A good checklist would certainly have lots of boxes nobody ticks, this one was clearly built around firefox feature lists (and maybe others, but not chrome as site isolation is left out).
- kerng 7y ago
  Telemetry seems like a big issue when its comes to security, and it's good to be explicitly called out in such evaluations.

ryanlol 7y ago

My objection really has nothing to do with the specific boxes. This is just fundamentally the wrong approach, as is demonstrated by the fact that every browser except IE essentially got a perfect score except for telemetry. Do you see a site isolation checkbox there btw? Missing one of the most important exploit mitigation technologies for browsers today strongly suggests that whoever made this list was either incompetent or deliberately picking boxes that firefox ticks. I'd assume that instead of having actual browser security experts build this list they had some amateurs attempt to build a list of existing security "features" in browsers, which isn't a sane approach at all and is bound to get results like this. A good checklist would almost certainly have lots of boxes nobody ticks.

jammygit 7y ago
With telemetry, it’s by definition non-secure since it’s leaking your information by design
- ryanlol 7y ago
  I'd argue that depends entirely on the contents of the telemetry, which don't appear to be a part of this assessment. Besides (since this isn't about defaults), if you're configuring your browser to disable telemetry couldn't you just as well configure your firewall to block it? Automatic updates also tend to leak information by design. But anyway, this has nothing to do with my larger point. A good checklist would certainly have lots of boxes nobody ticks, this one was clearly built around firefox feature lists (and maybe others, but not chrome as site isolation is left out).
kerng 7y ago
Telemetry seems like a big issue when its comes to security, and it's good to be explicitly called out in such evaluations.