Software Reviews

--April 10, 2006

Microsoft Internet Explorer 6.x Versus Mozilla Firefox 1.x

Our first product review will deal with an essential tool for accessing online financial services: an Internet Browser. We’ve decided to take a look at the two browser frontrunners and compare them on the grounds of security and function especially in relation to accessing popular financial sites online.

Security First

Our paramount concern when accessing financial information online is that no one else is seeing what we’re seeing. The worst case scenario is that when I access my bank account online, I inadvertently give my username and password to a hacker because my internet browser is compromised. A browser that leaves exploits unpatched for weeks or longer is an unacceptable risk for someone who depends on the Internet to complete financial transactions. During these unpatched periods if a computer becomes infested with malware or viruses that log keystrokes or allow hackers to see financial data, there isn’t much that can be done except reinstall the entire operating system as Microsoft disclosed in April 2006. Keeping the malware off the system is the first and last line of defense. A secure browser is essential.

OK. So there’s nothing new under the sun here, but as exploits abound, security can’t be emphasized enough. There has been a lot of press coverage over the last year that has repeatedly emphasized that Mozilla Firefox is the hands-down more secure browser. But “not so fast,” we say. We wanted some numbers to back up this claim up so we turned to a reputable security firm, Secunia. What we discovered might surprise you. In 2005 Microsoft Internet Explorer 6.x had 17 security advisories issued, while Firefox 1.x had 22.

Secunia kindly provides us with these separate graphs on each browser to illustrate the point:

On the surface this data makes Microsoft Internet Explorer look slightly more secure. However not all security exploits are created equal. While some exploits might cause my browser to crash, others might allow a hacker to take control of my computer remotely and install keystroke loggers and other compromising software at will. Therefore it is important to know how “critical” the exploits for each browser are. Again, Secunia has the answer. In 2005 47% of Internet Explorer’s exploits were rated either extremely or highly critical. Similarly, as demonstrated in these charts, 32% of Firefox’s exploits were either extremely or highly critical.

Again Secunia illustrates the data:

Hmm, compelling but still not a clear winner. Assuming that exploits are inevitable - and unfortunately that appears to be the current state of things - then the best we can hope for is that the software vendor will patch their product thoroughly and quickly. It’s on this front that Internet Explorer and Firefox begin to stand apart. Of the 17 Microsoft advisories in 2005, 41% were unpatched compared to no upatched exploits for Firefox. Furthermore, there seems to be consensus among security experts that the Firefox crew produces patches faster than Microsoft’s team. At the time of this review Microsoft has left a critical advisory unpatched for over a week with still no patch announced.

So we have to commend the Firefox crew for speedy patches and confirm that the balance tips clearly in Firefox’s favor on the security front.

Functionality Second:

The most secure browser in the world won’t do me any good if it won’t display the pages I need to access. This was an especially problematic issue for Firefox in the weeks and months immediately following the browser’s release. Many sites, in particular those that used Microsoft’s ActiveX controls, would not display correctly in Firefox since Firefox does not use ActiveX. Ironically ActiveX is one of the things that has cause repeated security problems for Microsoft. However now that more and more people are using Firefox, most sites now function perfectly in Mozilla’s browser, making the transition seamless for new users. In fact, we have yet to discover a financial site that does not work in Firefox.

Conclusion:

The edge goes to Firefox in terms of security. In terms of browser functionality on financial web sites we can find no difference. Since we take security very seriously here at TravelFinances.com this makes Firefox the clear browser winner.