One of the main problems is the integration of IE into the operating system. This makes it easier to exploit holes in both the OS and browser. Having the same engine controlling both the local zone and internet zone is just plain dangerous. Now that Microsoft wants to embed the browser even deeper into future OS, the problem will only get worse.

The focus for Microsoft has always been marketing features, glitz, eye candy, etc. They were not looking into the security implications of these features. Security was always an "after"thought - "after" an embarrassing new exploit. Since security was not built in, they are facing a losing battle trying to patch the holes and hopefully not breaking something else.

The only reason Microsoft embarked on this security initiative was because they were worried about all the bad publicity and that their users were getting ready to bolt to other alternatives.

The browser alternatives are built with security in mind. These alternatives are not perfect but I would bet that they are more secure than IE.

I have been using Mozilla since .96 and I am pleased with its operation and security. Is it perfect? No. I only use IE for Windows Update. I have better things to do than play the patch game, or worse, clean up after the latest exploit wrecks my system. I have my computer to get "real work" done.


[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/249/27140#27140