Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 0 down vote favorite

What is the validity of this article which claimed that IE is more secure than Chrome?

share|improve this question
while the general tone of skepticism is appreciated in this case, the question itself cannot be answered objectively, without argumentativeness... (except for the trivial "Don't believe what you read"....) – AviD♦ Jul 20 '11 at 12:23

closed as not constructive by AviD♦ Jul 20 '11 at 12:22

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or specific expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, see the FAQ for guidance.

4 Answers

up vote 0 down vote

It's phrases such as

With SmartScreen enabled and Application Reputation disabled, IE9 achieved a unique URL blocking score of 89% and over-time protection rating of 92%.

that mean you can only take it with a pinch of salt. This entire article is comparing apples to wildebeest - pointless.

I'd like to see them run the same sort of test with Firefox using No-Script and Ad-Aware etc. That would bring things closer to level.

share|improve this answer
apologies for digging up an old and closed question, but might I point out that SmartScreen comes pre-enabled on Internet Explorer, so for a general user it seems to be like a good comparison. Your general home user isn't going to install noscript and adware, while they will have SmartScreen on because it's shipped to them that way. – MatthewThepc Dec 31 '11 at 1:54
up vote 2 down vote

Don't believe 100% everything you read.

Personaly, everytime I see one product outpreformed others by huge margin I assume this is a case of PR and not of pure cold facts.

There are lots of events when, let's call them, hackers and enthusiasts are trying to bypass browsers defence. Call me sceptical, but to me they have much bigger value then any article on any site. E.g. Pwn2Own

share|improve this answer
1  
I agree with you, but even pwn2own is skewed. Even Charlie Miller admits he decides which prize he wants and picks an exploit well in advance. He stated that any of them would be easily exploitable. – Rory Alsop♦ Jul 20 '11 at 8:49
1  
Ok, bad example, but the point is still there (and the point is that I much more trust "little" people who are dealing with the security every day then some big and fancy portal which might be paid to write what they wrote). – StupidOne Jul 20 '11 at 8:59
+1 for that - totally on the same page :-) – Rory Alsop♦ Jul 20 '11 at 9:11
up vote 0 down vote

This is similar to the argument that Windows is more secure than OS X because it's been attacked more and is now far more hardened. The analogy goes that Windows is like a barricaded house in a bad neighborhood while OS X is like a house with unlocked doors in the middle of the country.

Which is safer?

Notice I didn't say more secure. They are two different things.

IE has been attacked more, and been defended more. It's likely more "secure" than other browsers in some ways because of this. But this doesn't mean that you're safer if you use IE -- it means that if the threats and number of attacks were the same you would be.

But they're not.

TL;DR: if you ever hear anyone give you a one sentence answer to this question, be skeptical. Risk is a complex animal.

share|improve this answer
the default user on OSX isn't root... That in itself goes a long way. – Hubert Kario Jul 20 '11 at 9:03
up vote 1 down vote

Well, the author does explain his position:

This isn’t the first time I’ve criticized research published by NSS Labs, and definitely not the last. Not only is the research ignoring the existence of client-side vulnerabilities, it’s methodology is fundamentally flawed taking into consideration the limited number of URLs the browsers are tested against, combined with lack of testing of the additional protection features offered by the competing browsers and the related security add-ons.

The numbers are presumably sound, but it is a very specific test against social engineering-driven malware.

Can you trust IE to protect against that sort of threat, probably. Can you trust it to protect you from client-side vulnerabilities in Windows or IE or the plugins it hosts? It doesn't say.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.