Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am attempting to locate a lightweight browser that adheres to security standards when browsing the web and was wondering if I can measure the level of security provided by each browser so that I can benchmark them.

share|improve this question
    
"It is impossible to make something secure, only less insecure." –  Darth Android Jul 18 '11 at 22:44
    
The best measure is how many VMs can you nest it. . . –  surfasb Jul 19 '11 at 5:59
    
@surfasb - What do you mean? –  PeanutsMonkey Jul 19 '11 at 22:07
add comment

1 Answer

up vote 0 down vote accepted

No, not really. You can measure how long known security vulnerabilities go unpatched, but those usually are fixed pretty quickly, but there's no way to measure how 'secure' a browser is. The real issues are the vulnerabilities that nobody knows about-- and well, nobody knows about those.

Instead, we can measure how long browsers are known to be insecure, which will give better chances of the browser not being exploited. The first part about evaluating this is understanding that there is no such thing as an 'unhackable' browser (or 'unhackable' program, for that matter), only browsers that are harder to hack than others.

The best you really can do in this area is look at what security features the browsers have (assuming those don't have holes in them themselves), and how quickly the dev teams are able to fix vulnerabilities once they arise.

An example of security features would be chrome's sandbox; I'd generally trust that to make it harder to hack that browser than say, IE7 or IE8 with their lack of a sandbox (IE9 has a sandbox I think). You can also add your own layers of security, such as running the browser in a VM (Ex. Windows 7's Virtual XP mode) or another sandbox (such as Sandboxie)

Comparison of browser vulnerabilities can be done using charts that compare the number of unpatched vulnerabilities (Note, link intended to be an example and not guaranteed to be in any way accurate; please look into your own research for more reliable results).

The open source teams for firefox and chrome generally have a better track record for getting vulnerabilities patched quickly and those patches pushed out to users when compared to IE's closed source model. Generally speaking the browsers with larger communities looking over their source code would hopefully have better code-- more eyes looking for vulnerabilities, better chances of them being found, etc.

The key to take away is that the real question you want to ask is "Which browsers minimize the risk of being exploited the most?", which is subtly, but fundamentally different from the original question.

share|improve this answer
    
Thanks. How do you then compare say no browser to another in terms of security? For example I am attempting to evavulate KMeleon over FireFox and Chrome before it is deployed to numerous PCs. –  PeanutsMonkey Jul 19 '11 at 22:08
    
@PeanutsMonkey See my edits. –  Darth Android Jul 20 '11 at 14:15
    
Thanks Darth Android. Seeing that I am looking at possibly deploying KMeleon, where can I find more information about unpatched bugs, issues pertaining to each browser? –  PeanutsMonkey Jul 23 '11 at 1:27
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.