The Anti-virus Times

Users regularly ask us why Dr.Web doesn't incorporate certain features that are widely advertised by other developers. Could it be, they say, that you lack the necessary skills? Once again we’re talking about secure browsers. So, perhaps, it’s time we settled this matter once and for all.

There exist several established practices for making a browser “more secure” than a standard browser: launching a browser in a sandbox, using a different browser, or starting a browser under a special account or via another application.

Unfortunately, none of these methods is guaranteed to deliver a good result.

Different kinds of sandboxes exist: some are more resource-consuming and some less so; some have compatibility issues with other applications or are prone to glitches. While running browsers in a sandbox may address the issue of suspicious applications and files being launched in a system, it does nothing to resolve security issues involving the exchange of information. For example, it won't protect you against man-in-the-middle attacks. Furthermore, certain malicious programs are known to reach beyond sandboxes by exploiting certain vulnerabilities.

And from a security standpoint, a separate browser is a double-edged sword. If the browser is relatively unknown, then in theory the Security Through Obscurity principle may apply. However, should the browser's popularity increase, vulnerability and exploit enthusiasts will switch their attention to the browser, and thus it will cease being secure. And a small browser developer team will unlikely be able to discover and close vulnerabilities as fast as the "giants" whose browsers are used by millions of people. Furthermore, designing a browser from scratch is a very ambitious project requiring substantial investment, while its prospects are somewhat uncertain. A developer may also choose to design a browser using an existing engine like Chromium with all its pros and cons, including engine vulnerabilities.

A dialogue that took place between one of our customers and one of our support engineers in 2016 will best illustrate what happens when a conventional browser is turned into a secure one.

Just like in medicine, it’s better to neutralise a disease rather than fight its symptoms by alleviating a fever for a little while. Or, even better, prevent an infection from ever happening?