Security - Browser Recommendations

2006/07/27 - 2008/04/18

This is a demo page to show the advice that would be given if your browser were:

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.5) Gecko/20041217

The Mozilla Suite is no longer supported and is affected by several known vulnerabilities fixed in newer Mozilla-based products. All users are urged to upgrade to a supported product.

Mozilla: The last release was Mozilla 1.7.13 - released April 21, 2006 - but that has security issues. We cannot recommend any version -- you should try your vendor provided browser or perhaps Firefox.

Vendor/Download: See the Vendor Site and Known Vulnerabilities.

JavaScript and Java: Many browsers support JavaScript and Java -- both have a history of security problems. Both should be disabled or only enabled at trusted sites. If enabled you should be very cautious about the sites you visit. Some browsers and many web sites rely on JavaScript so this recommendation may be difficult.

Browser Plugins: Many browser support the addition of plugins like Java, Flash, Shockwave, QuickTime, etc. These plugins come with security problems of their own and will require periodic updates. We recommend you avoid installing any plugins unless you have strong requirements. Further that you only use these plugins at trusted sites.

Vendor Browser: On the Windows platform the vendor supported browser is Internet Explorer.

Automatic Updates: Patches for Microsoft Windows, including core components like the IE browser, are available at the Microsoft Update Center (you will need to be an administrator to apply updates). It is essential that you have your system and browser patched as many security problems have been identified. We recommend that you configure your system for automatic patching -- see the Microsoft articles on Automatic Updates and the Windows/XP Security Center.

Least Privilege: On many Windows systems users login with "Power User" or "Administrator" privileges -- this is a dangerous practice . You should have ordinary user account with no special privileges and use that account for everyday tasks. Use the account with administrator privileges only when installing new software, changing system configurations, and other important tasks.

Recommended OS: We recommend Windows XP/SP2 on the desktop and discourage all older Windows operating systems (viz, Windows 95, 98, ME, NT 4 and Windows 2000). There is very little support for those systems from the vendor. We understand that IE 7 will only be released for the current supported environment and will not be available on these older systems. You are running on Windows NT 5.1 (XP) -- that is a recommended platform.

Be careful: You should be careful about the web sites you visit. Many compromises can be traced to malicious content hosted at dubious web sites offering "free" services -- pornography sites are notorious.

Finally: This document is an incomplete work in progress, if you have any security advice to share please do. Your comments are appreciated and will help others.

See Also: We have similar advice documents on other browsers including Blackberry, Camino (OS X), Firefox, KDE Konqueror (Linux/FreeBSD), Lynx (Unix), Opera (Windows/Linux), Internet Explorer, Mozilla, Safari and SeaMonkey.

(by) Reg Quinton, Information Systems and Technology