Autorităţile germane au desemnat Firefox drept cel mai bine securizat browser

Biroul de Securitate Informaţională din Germania (BSI) a realizat un nou audit al browserelor pentru desktop şi a decis că Firefox de la Mozilla este cel mai sigur dintre toate cele testate. Agenţia germană a actualizat de curând criteriile pentru securitate online, iar Firefox a fost singurul browser care a reuşit să trecă toate testele, dar să şi ofere acces la toate capabilităţile de securizare pe care BSI le cere.

Acest audit pentru browsere web este realizat pentru a putea recomanda software care se încadrează în standardele de securitate ale BSI atât instituţiilor de stat, cât şi companiilor private. În cadrul auditului au fost folosite patru browsere: Firefox 68 (ESR), Google Chrome 76, Internet Explorer 11 şi Microsoft Edge 44. Acestea sunt probabil cele mai populare browsere folosite în instituţiile de stat, întrucât alternative precum Safari, Opera sau Vivaldi, nu au fost luate în seamă.

Iată întreaga listă de criterii necesare pentru ca un browser să fie desemnat drept „securizat” de către BSI:

• Must support TLS
• Must have a list of trusted certificates- Must support extended validation (EV) certificates
• Must verify loaded certificates against a Certification Revocation List (CRL) or an Online Certificate Status Protocol (OCSP)
• The browser must use icons or color highlights to show when communications to a remote server is encrypted or in plaintext- Connections to remote websites running on expired certificates must be allowed only after specific user approval
• Must support HTTP Strict Transport Security (HSTS) (RFC 6797)
• Must support Same Origin Policy (SOP)- Must support Content Security Policy (CSP) 2.0
• Must support Sub-resource integrity (SRI)
• Must support automatic updates- Must support a separate update mechanism for crucial browser components and extensions
• Browser updates must be signed and verifiable
• Browser’s password manager must store passwords in an encrypted form- Access to the browser’s built-in password vault must be allowed only after the user has entered a master password
• User must be able to delete passwords from the browser’s password manager
• Users must be able to block or delete cookie files- Users must be able to block or delete autocomplete history
• Users must be able to block or delete browsing history
• Organization admins must be able to configure or block browsers from sending telemetry/usage data- Browsers must support a mechanism to check for harmful content/URLs
• Browsers should let organizations run locally-stored URL blacklists
• Must support a settings section where users can enable/disable plugins, extensions, or JavaScript- Browsers must be able to import centrally-created configuration settings, ideal for wide-scale enterprise deployments
• Must allow admins to disable cloud-based profile synchronization features
• Must run after its initialization with minimal rights in the operating system- Must support sandboxing. All browser components must be isolated from each other and the operating system. Communication between the isolated components may only take place via defined interfaces. Direct access to resources of isolated components must not be possible.
• Web pages need to be isolated from each other, ideally in the form of stand-alone processes. Thread-level isolation is also allowed.
• Browsers must be coded using programming languages that support stack and heap memory protections- Browser vendor must provide security updates no longer than 21 days after the public disclosure of a security flaw. If the primary browser vendor fails to provide a security update, organizations must move to a new browser.
• Browsers must use OS memory protections like Address Space Layout Randomization (ASLR) or Data Execution Prevention (DEP).- Organization administrators must be able to regulate or block the installation of unsanctioned add-ons/extensions.

Iată şi motivele pentru care alte browsere testate nu s-au încadrat în normele BSI:

• Lack of support for a master password mechanism (Chrome, IE, Edge)
• No built-in update mechanism (IE)
• No option to block telemetry collection (Chrome, IE, Edge)
• No SOP (Same Origin Policy) support (IE)
• No CSP (Content Security Policy) support (IE)
• No SRI (Subresource Integrity) support (IE)
• No support for browser profiles, different configurations (IE, Edge)
• Lack of organizational transparency (Chrome, IE, Edge)