I'm working on security project in the browsing field but I am confused about some points.

  1. What does "security in browsers" mean? Is it all about secure connections or there are other aspects?

  2. How does the level of security differ from one browser to another?

  3. Insecure connection: browser issue or network issue?

closed as too broad by Neil Smithline, Xander, Steffen Ullrich, TildalWave, Matthew Mar 14 '16 at 21:49

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • This question is probably too broad for this site. The answer would take a book (or maybe volumes of books). Network security is only a small part of browser security. The OWASP Top 10 may be a good place to get started. If this is a school project, you may need to get a more specific assignment. – Neil Smithline Mar 14 '16 at 21:35

"Browser security" is about far more than secure connections. Using HTTPS to secure the connection between browser and server is an important part of browser security, but it's certainly not the whole thing. To show what I mean, here are some things off the top of my head (and by the way, I have never done any work related to browsers, these are just things I've heard about):

  • Javascript Sandboxing: So your browser is going to download and run arbitrary javascript code. What if this code is malicious? Can it read the user's personal files on the hard drive? Can it modify files on the hard drive to plant viruses? Can it read data from other tabs? Can it force the browser to do something malicious on its behalf? These are things you need to think about when designing a browser.
  • Browser extensions: Most major browsers have some system for people to add extensions written by other random people. Unlike javascript, once installed these are part of the browser and can not be effectively sandboxed. What security features exist around these? Do they have to be reviewed by a security team before being allowed on the app store? Will the browser monitor them and disable the extension if it breaks the rules?
  • Cross-Site Scripting (XSS): If I have two tabs open, can one tab get access to the cookies / session info for the other tab, allowing it to impersonate the other tab through GET / POST requests?
  • Media file exploits: Many browsers now include built-in media libraries for things like PDF, audio, video, etc. These are very complex media types with long lists of supported codecs. Libraries that parse them are notoriously buggy for things like buffer overflows that allow arbitrary code execution. How much security analysis have you done on the libraries that your browser compiles against?
  • Root Certificates: Most browsers now embed (aka "pin") the root SSL certificates into the source code of the browser. How fast will the browser issue a security patch if one of the root CAs is reported to have a breach?

Those are just examples off the top of my head. Bottom line: "Browser Security" is a HUGE topic.

To answer your other two questions:

  1. How does the level of security differ from one browser to another?

That depends on which browsers you are comparing. Firefox and Chrome? They are pretty similar. Firefox and the browser my friend wrote for fun last weekend? There's a pretty big difference. Everything else will be somewhere in the middle.

  1. Insecure connection: browser issue or network issue?

Yes. Also No.

Sometimes it's the browser's fault. Sometimes it's the network's fault. Sometimes it's the server's fault, or the OS's fault, or the user's fault, or the IT department's fault, or openssl's fault, or the VPN's fault ... the list goes on.

Actually, scratch that, a good security developer will write their code under the assumption that the other machines on the network are malicious (hopefully, including routers). So a faulty network should not be able to cause an insecure connection, but even if it can that doesn't mean it's the browser's fault: it could be any of those other things I mentioned.

Not the answer you're looking for? Browse other questions tagged or ask your own question.