5

The more I read about TLS, the more I get convinced that the browser is the weakest link in the chain.

I know that nobody agrees with me as there are no articles about that in Google, but it looks fairly simply to convince users to use unknown (or malicious) browsers to browse the Internet.

Many people download and install any software, as long it passes the anti virus scan.

How dangerous is it to use unknown browsers?

13
  • 14
    Do you mean unknown browsers or untrusted? I would say it's dangerous to use any untrusted software on your system. – RoraΖ Oct 9 '14 at 11:19
  • 2
    Not really. I prefer not to experiment with unknown software as it's inviting malware into your system. – RoraΖ Oct 9 '14 at 12:55
  • 2
    What you're describing is basically a trojan horse, and indeed, it's among the most common methods of infection. – ntoskrnl Oct 9 '14 at 15:38
  • 4
    "the browser is the weakest link in the chain." .. no, the human is. – PlasmaHH Oct 9 '14 at 20:12
  • 2
    @Ulkoma not all Trojan horses can be detected by an AV. – stackErr Oct 9 '14 at 20:25
18

It is very dangerous.

  • You are correct in pointing out that the browser decides whether or not the connection is secure (HTTPS). The browser not only initiates the connection, it also chooses the symmetric key that will be used for the secure connection (assymetric keys are only used to set up the connection). Hypothetically, a browser could use a predefined symmetric key, and the user would still think the session is safely encrypted (even if he/she would inspect the traffic using wireshark for example). Moreover, the browser could choose to accept any certificate as valid, which is probably the easiest hack to implement.
  • The unknown browser could also not care about the same-origin policy, leading to authentication cookies from one domain being sent to any other domain. There's more than that to the same-origin policy, please consult this website for more information.
  • Several HTTP headers (control whether or not you are being iframed, strict-transport-security, etc.), which are more and more being used by web applications to obtain a 'second line of defense', will be useless. (For a complete list, consult OWASP)
  • Essentially, you are always victim of a MITB, thus being vulnerable for all kinds of attacks which target what you put in your browser cache, cookies, requests, etc. There are too many options for the attacker to describe.

The more I think about it, the more options are available. I agree with raz that is generally dangerous to use any untrusted software on your system.

2
  • +1 for : is generally dangerous to use any untrusted software on your system. Using web app in browser instead of desktop app is nearly always a good idea from a security standpoint. – Gudradain Oct 9 '14 at 13:10
  • @Gudradain if you trust your browser to to perfect job in sandboxing the application. In some cases it might be better to use OS-level restrictions (read e.g. BSD jails/Linux containers or grsecurity/SELinux/AppArmor/... on Linux), since that usually receives more attention during development. – peterph Oct 9 '14 at 21:36
5

It isn't good to install any untrusted software, but the browser is obviously the holiest of holys. And I've seen quite a few applications begin to implement 'native' by using WebKit and local WebSockets.

That itself isn't too terrible, yes technically the application could be used to open Facebook as well because it is using WebKit, but as long as it doesn't try to get you to do so, that isn't too bad.

I would never use an untrusted browser for logging into anything, except in the WebKit-application example, logging into that particular application itself. But if it tried to do a redirect to Google or Facebook in order to OAuth/OpenID, N.O.P.E., uninstall it.

3

The more I read about TLS, the more I get convinced that the browser is the weakest link in the chain.

I don't think so, because I think the user itself is the weakest link:

  • The user can often be convinced to follow insecure links, even if the browser explicitly warns against it.
  • The user can be convinced to install any other software, like dubious plugins, alleged virus scanners which are malware in reality or even different browsers.
  • The user trusts the producer of the browser or OS, that every of the 100s of trusted CA in the browser/OS can be fully trusted.

The user is the weakest link because only (s)he ultimately decides whom to trust and which software to install or which sites to visit. Unfortunately these are in reality really complex decisions and the user is unable to do decide themselves, so it defers the decision to the software producers in the hope that they know what the best is and that they don't cheat.

How dangerous is it to use unknown browsers?

It is no more or no less dangerous than to install any other software, where the user does not know what the software really does. The user will trust the software to do the right thing, but the software might do different things instead.

It does not matter much if the user uses a mainstream browser, but also installs some other software which can hook into the browser and sniff everything, modify contents and steal credentials.

2

Contrary to some answers here, I'd say it could be extremely dangerous. If you're a target, I'd love to sit in your browser and watch you as you reveal your accounts, passwords, thoughts etc. It's almost as good as taking over your computer, because 90% of your communications with external world would probably go through your browser(s). It's even easier to attack your browser if you like to use 3rd party addons.

For example, If you want to access TOR, what would you do? Download the TOR browser?

  • If I hijack your downloading session and send you a modified browser bundle with keylogger/backdoor, would you know?
  • How would you know if the software package itself was never compromised?

Above example is from national security / crime prevention perspective. If I want to steal your data just for profit, your browser is again a high value target that might be easier to attack than other nodes.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.