Travel down the slopes of blog feeds, drive off the machete-chopped paths of search engines, and adventure through the jungle of wikis, peeling back the leaes of hyperlink after hyperlink. Web browsing is where we spend a lot of our online life. A web browser is the vehicle for traversing the internet, and like a proper car, should provide security and expand the boundaries of liberty.
However Ethan Heilman, a cryptography graduate student at Boston University and a member of the coding group BUSec says, “Browser security is a moving target with browsers releasing new security features, while at the same time threats and attack techniques are evolving and changing.” The best browser one day may be inferior the next day.
Heilman says that currently, many people think Google Chrome is more secure than its competitor Mozilla Firefox. This perception is not exactly true, according to Heilman, who cited evidence from the security reviewer CVE Details. In the past three years, Chrome has had 13 code execution vulnerabilities, while Firefox has had 180. A code execution vulnerability is the seam in the browser armor, a software bug through which a hacker injects malicious code that could worm inwards to reach the critical programming of a device.
Heilman also says that Firefox was dropped from this year’s Pwn2Own, one of the premier hacking conventions where participants inspect and test web browsers for weak points. Firefox was excluded because it hadn’t made enough security advancements in the past year, according to the Pwn2Own organizers. Considering these facts, Chrome may offer better cybersecurity prospects.
Yet, from a privacy standpoint, one glaring downside of Chrome and most Google products is that they are avenues for the data giant to collect your data and analyze you. For example, when you type into the address bar at the top of the Chrome window, drop-down search recommendations appear. You type “test,” and the drop-down reads “test taking strategies.” Pretty handy, right?
But the technology that powers this service lets Google see everything you type into this address bar (even if you never press the enter button). A user needs to master the labyrinth of privacy controls on the Chrome Support web pages to stop many of the Google services from collecting your data. This is particularly time-consuming because there is separate data collection associated with each Google account and individual device; laptop, iPad, phone, etc.
Also, we are assuming everyone at Google follows the company’s privacy policy. But if someone breaks the rules, that’s a whole lot of your personal data at risk.
The consumer who values BOTH security and privacy is faced with a tough choice, between Firefox and Chrome. Regardless of which you choose, some critical plugins are available for each, and I’ll elaborate in the next column installment. By the way, Internet Explorer had almost 500 code execution vulnerabilities in the past three years, and while Safari narrowly beat out Firefox in this area, the Apple browser doesn’t have access to certain security and privacy plugins.
Lastly, if total online anonymity is your preference, then look to the Tor Browser.
“The Tor Browser is essentially exactly like Firefox. It has the same source code. The difference is what’s underneath. “[The] Tor [network] is the major difference,” says Joseph Cohen, who led two teams to second place at the yearly hacking competition held by the MIT Lincoln Lab.
According to The Tor Project’s website, their technology “prevents somebody watching your internet connection from learning what sites you visit, and it prevents the sites you visit from knowing your physical location.”
How does it work? Putting it very simply, Tor bounces your communications around the world to shake anyone who might be following you.
The Tor Browser also comes with privacy and security plugins bundled-in. Whistleblowers and journalists use the browser because it boots up completely fresh, free of settings or cookies from previous browsing sessions that might betray your identity to visited websites.
“You blend in. You don’t have any of your browsing habits tied to that. There is nothing to tie it back to you. The Tor Browser is as if you sat down at a public machine,” says Cohen, who recently graduating from the computer science PhD program at the University of Massachusetts Boston.
Still, the Tor Browser isn’t for everyone, or convenient for all situations. Sometimes we want to save our browsing history, or prefer password boxes to automatically refill. For that we use Firefox or Chrome. So in the next Digital Armor installment I will describe some browser plugins that you can use to trick out your defense and take control of your privacy.
Digital Armor: Web Browsers
September 16, 2016
![Google Chrome Logo](https://umassmedia.com/wp-content/uploads/2016/09/43a7d3a2e45eefbb86710b9185cb863b-1.png)
Google Chrome Logo