Can Mozilla Support Claims of Firefox Being the Most Secure Web Browser?

[FULL DISCLOSURE: In addition to being a 20-year Security Guy, I work for Microsoft. While I try hard to focus on objective data, go ahead and assume bias, if you wish, and challenge my analysis with your own comments—you’ll be helping me fulfill my goal of ensuring all sides of security claims are thoroughly examined and rigorously debated in the public view.]

A little over a year ago, I challenged some of the security claims asserted by Mozilla that Firefox “won’t harbor nearly as many security flaws as those that have Microsoft’s Internet Explorer” with an Internet Explorer and Firefox Vulnerability Analysis. Of course, the publication of my report was quickly followed by a vigorous rebuttal from Mozilla’s Mike Shaver (please do read it, so you have his viewpoint).

While that rebuttal makes a valiant effort at trying to redirect the conversation away from Firefox and towards Microsoft, it avoids supporting or addressing the security marketing claims that Mozilla has proliferated since they first launched Firefox. While asserting that my analysis of security flaws is a poor measure of security, the rebuttal ignored the fact that it was the Mozilla CEO’s public claims that Firefox would not have half the security flaws of Internet Explorer that initiated my investigation.

Here is the thing: Nobody has twisted Mozilla’s arm to make security claims and assertions. They get to do that, no objection from me—it is part of business. However, if they choose to make security a marketing theme (and beyond that, target specific products), then I also believe it opens those claims to efforts at fact-checking and open discussion.

Take a look at the Firefox security page, for example, and note what I consider the top three marketing claims that Mozilla asserts:

• The large-font title of “The Safest Web Browser“—a claim that we should look at in depth.
• The claim of “Firefox keeps your personal info personal and your online interests away from the bad guys.”
• “When Are You At Risk? An independent study shows that, in 2006, IE users were vulnerable to online threats 78 percent of the time.

I think those three items will provide some nice discussion for subsequent parts of this article series—where I will dig into these security marketing points to analyze and discuss in more detail. That 2006 exposure report looks very interesting, for example, as it makes me wonder how well it stands up in more recent time periods.

Over the course of the next few parts to this series, I hope to leverage the investigation of these security claims to look at the current landscape of browser security, where it has been and hopefully see where it might be going next. And, along the way, we’ll try to see exactly how supportable these security claims are.

Jeff Jones is a security director in Microsoft’s Trustworthy Computing group. In this role, Jeff draws upon his years of security experience to work with enterprise CSOs and Microsoft’s internal security teams to drive practical and measurable security improvements into Microsoft process and products.