Linked by Thom Holwerda on Fri 21st Mar 2008 22:21 UTC
Thread beginning with comment 306035
To view parent comment, click here.
To read all comments associated with this story, please click here.
To view parent comment, click here.
To read all comments associated with this story, please click here.
This is only partly correct.
It is possible to add a feature that by itself can be said to add to security, compared to the same browser compiled without that feature.
Anti-phishing provisions is one such feature that comes to mind.
It is possible to add a feature that by itself can be said to add to security, compared to the same browser compiled without that feature.
Anti-phishing provisions is one such feature that comes to mind.
Not true. Every bit of code that you add to a product increases the potential attack surface. The anti-phishing provisions are intended to prevent a particular problem; however, besides addressing that problem, they may open you up to other problems (ie. buffer overflows, privilege escalations, and so on).
Your statement doesn't disprove his'.
There are several kinds of security threads. If a feature is added to help on a specific thread (like phising), this adds to the overall security of the product usage.
It could be that this additional code opens security holes in other regards, but this is not mandatory.





Member since:
2007-02-17
As usual, this will have to be proven, not stated. I mean after reading "improved security" in every article about a new browser that has been comming up for a few years now, we'd have to feel so secure we shouldn't be even able to handle it ;-)
And yet, Bruce Schneier still says the state of security isn't getting any better. I guess he doesn't use firefox... or he's right :-D
This is only partly correct.
It is possible to add a feature that by itself can be said to add to security, compared to the same browser compiled without that feature.
Anti-phishing provisions is one such feature that comes to mind.