Firefox phishing filter fails

[Update: Mozilla’s PR agency says the anti-phishing feature isn’t fully enabled in Firefox 2 Beta 1. Details here.]

Over at ZDNet, I’ve just published a lengthy comparison of the security features in the most recent beta releases of Internet Explorer 7 and Firefox 2. (The comparison is entitled IE7 or Firefox 2: Which browser is more secure? It includes a detailed image gallery so you can draw your own conclusions.)

One prominent feature of each new release is technology to detect so-called phishing sites, which try to spoof legitimate sites and deceive visitors into giving up personal information like credit card numbers and banking account login details. Like most people, I was initially skeptical about whether this technology would work, so over the past few months I’ve been putting IE7’s phishing filter to the test. Normally I just delete those phishing messages, but lately I’ve been clicking on every single one to see what happens. Surprisingly, IE7 has nailed one fake site after another. I haven’t kept detailed records, but the hit rate has been nearly 100%.

I’ve only begun using the Firefox beta in the past few days, so I have only a small sample size to work with. But so far it has missed every one of four phishing sites I’ve pointed it to, each of which has been detected by IE7. I’ve tried monkeying with the settings for the anti-phishing option in FF2, with no luck, and I’ve repeated the installation on a separate computer with identical results. (Both computers were running stock installations of Windows XP.)

Frankly, this is baffling to me. Both Microsoft and Mozilla have been testing this feature for a year. In Mozilla’s case, the testing has been done by Google, which developed the technology as part of its Google Toolbar for Firefox. As a control, I installed Google’s Firefox toolbar on the latest official release of Firefox, 1.5.0.6. It failed to detect two obvious phishing sites as well. (Two other links that I had used for testing yesterday have already been taken down.)

I’m going to begin monitoring this feature a lot more closely and will report my results periodically here.

Someone really needs a long weekend

Specifically, Kate Bevan of  The Guardian:

Firefox is wonderful. It’s up there with chocolate and sex on the grand scale of great things about being alive.

Firefox is a really nice browser, but there is no piece of software that deserves to be in the same category as chocolate or sex. There’s no hardware that belongs in that category, either. At least, nothing silicon-based.

Firefox OS? Unlikely

Todd Bishop of the Seattle PI speculates on whether the Mozilla crew is thinking of spinning off a Firefox PC operating system. It’s pretty thin speculation, and I’d dismiss it out of hand, at least in the guise of a built-from-the-ground-up OS. It takes years to build an OS kernel from scratch.

Now, it’s certainly possible that the Firefox folks and their good buddies at Google could pick a Linux distro, slap some app software into it, and make it available as a CD or even an OEM install. But it’s hard to imagine how yet another Linux is going to make much of a dent in the Microsoft/Apple market for consumer operating systems.

More Firefox irony

So, you’re a Firefox evangelist and you’re going to preach about the evils of ActiveX:

For years, Mozilla struggled with website compatibility issues because it did not support Microsoft’s ActiveX technology, another major vector for security attacks on users. Not only would it have been a lot of work to reverse engineer and build Mozilla support for ActiveX, it would have opened Mozilla up to some of the worst threats on the Web. It would have been a bad idea. With the upcoming IE 7 (promised almost a year and a half ago) Microsoft says that “allowing ActiveX controls to run in IE should be the exception”. Good idea. And only about 5 years late.

(Clearing throat and doing best Keith Olbermann impersonation here…)

OK, then maybe your webpage shouldn’t include an embedded ActiveX control:

Here’s a snippet of the source code from the page (with angle brackets converted to square brackets and URL broken so I don’t try to force a QuickTime control down my visitors’ throats):

[object codebase=”http: //www.apple.com/qtactivex/qtplugin.cab” width=”480″ classid=”clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B” height=”376″] [emphasis added]

Just sayin’.

This site’s browser stats updated

With the help of SiteMeter, I’ve been tracking which browser visitors to this site are using since October 2004. Here’s the latest:

Browser_share_20060430

The last time I published these stats was in August 2005. The share of visitors using Firefox or Mozilla has gone up very slightly, from 33.2% last August to 35.2% today, a gain of 2 percentage points. It wasn’t all at Internet Explorer’s expense, however. IE delivered an even 60% market share during the same period, down 0.6% overall, with the IE7 beta running on the PCs of 6.5% of all visitors.

From these stats, it’s pretty clear that this is a two-horse race. Netscape continued its slide into irrelevancy, with its share dropping almost in half, to 0.7%. Opera could only gain a half a percentage point in share despite the company’s decision last September to give away the browser.

I’m willing to draw another conclusion as well – at least tentatively. The easy gains for Firefox are over. I’ll be very surprised if Firefox is able to make any significant gains in share when I look at this snapshot six months from now. In fact, I’d be willing to bet that IE will gain back some ground during that time with the help of IE7.

A Firefox versus IE7 smackdown

For the past few months I’ve been using Firefox 1.5 and a succession of Internet Explorer 7 betas side by side, in roughly equal percentages. Most of the time, I barely noticed the difference. That’s an enormous improvement over IE6, where Firefox is clearly the btter browser by just about any objective measure.

Last week Microsoft gave me an advance release of IE7 Beta 2 for Windows XP. It’s clearly Microsoft’s attempt to catch up after 18 months of getting seriously whupped by Firefox. Techweb asked for a follow-up to my IE7 preview piece from last February, so I took the opportunity to compare IE7 and Firefox as directly as possible.

You can read  IE 7 For XP Beta 2: Has Firefox Met Its Match? (it also includes a gallery of IE7 screen shots that starts here).

IE7B2019

If you’re too busy, here’s the conclusion:

On a straight, feature-for-feature comparison, IE7 stacks up well against Firefox. If its improved security model lives up to its design specs, malware distributors will find it much more difficult to make a dishonest living, and the tabbed browsing features in the new release should make it much easier to deal with multiple pages.

The biggest hurdle that Internet Explorer has to overcome, however, is one that doesn’t fit on any features chart. Its tattered reputation — especially when it comes to security — has created an indelible negative impression among the technically savvy users who’ve enthusiastically adopted Firefox so far. Even if the final release of IE7 improves mightily over the current beta, building that new and improved reputation will be an uphill climb.

The security features in IE7 look good on paper, but this week’s release marks the first time IE7 has been thrown into the crucible that is the Internet. The criminal gangs that control the malware racket are going to be gunning for IE7 and mercilessly probing for weaknesses. I’ll need to see a year’s worth of security bulletins before I’m ready to accept the idea that this time it really is different and IE7 is genuinely safe enough to recommend without reservation to friends and family members.

“Good enough” isn’t good enough for Microsoft in the case of IE7. On issues of security in particular, they’re going to have to earn back trust from a generation that’s been burned pretty badly by security flaws in Windows and IE. That will take time, and there’s no guarantee of success.

Meanwhile, Firefox has one pretty huge ally. Visit Google’s home page using Internet Explorer today and you’ll see the first ad to ever appear on that page – urging you to switch to Firefox.

Links

Feel free to leave comments here.

Firefox fanatics decide to make money by punishing users

Last night I spent an hour or two visiting unfamiliar websites while researching a topic for an upcoming column. In the process, I discovered a new and exceedingly obnoxious trend: Some members of the Firefox community have decided that you shouldn’t be allowed to view their sites correctly – or, in some cases, at all – unless you’re using the One True Browser.

On at least three sites I visited last night, the home page has been coded so that it looks different if you visit using Internet Explorer. Specifically, the top of the page – a region approximately 180 pixels deep, occupying the full width of the page – is taken over by a large banner that reads: “We see you’re using Internet Explorer. Try Firefox, you’ll like it better.” That’s followed by a bulleted list of the advantages of Firefox, and a big bold arrow pointing to a button where the hapless visitor can download Firefox with the Google toolbar.

This is bullshit.

I’ve already got Firefox installed on this computer, and I use it more than half the time. But for this project I’m using Internet Explorer. In this case, the web designer says he wants me to have a better browsing experience, so he has deliberately created a degraded and obnoxious browsing experience for me. What’s wrong with that picture?

And despite the altruistic language, let’s be clear – this is about money. If I click that button and download the software, the website owner gets paid by Google. In fact, this is worse than a pop-up ad, because I can’t get rid of it. Every time I visit that site, the obnoxious oversize banner appears, telling me how stupid I am and how smart the website designer is.

This campaign is being run by a site called Explorer Destroyer, which offers three versions of its punish-IE-users code. The one I ran into is the Gentle Encouragement version. There’s also a Semi-serious version, which forces the user to view a splash page before seeing the site, and a Dead Serious version, which completely blocks the site from viewing by any browser that uses the IE user agent. (You can see a demo here.)

I thought the open source movement was about giving people options and about adhering to standards. Hey, Asa, here’s a question for you: Does the Firefox community really advocate designing websites so that they’re deliberately broken if you view them in any browser other than Firefox? What would the community say if Microsoft did the same?

The world’s most bloated browser

This made me laugh out loud:

Yesterday I decided to undertake an experiment. My favourite browser, Firefox, allows its users to add extensions. Currently 1148 extensions are available at Mozilla update. I decided to install 100 of the most popular extensions at the same time, trying to avoid those that duplicated others functionality.

Here’s a small sample of what the final result looked like (click the screen here to go to the original post and see the complete, overwhelming mess).

The author initially said, “Overall I was very impressed. The browser was a little slow on my machine (which doesn’t have impressive specs) but there were no crashes except when installing the extensions.”

After a couple days, however, the dark side of overcustomizing had emerged:

It takes around seven seconds to start up.

It freezes for at least one second between pages (I guess a lot is hanging on the onLoad.)

It has not yet crashed, half hour or so I’ve browsed with it, since all the extensions have been installed (for some reason it did crash immediatly after installing them, before restarting.)

So, Firefox users, how many extensions do you have installed?