The German Federal Office for Information Security (or BSI) has published a report (in German) which evaluates the most popular modern web browsers against the BSI’s own guidelines for ‘modern secure browsers’ and only Firefox emerges with flying colours.
The audit examined Mozilla Firefox 68 (Extended Support Release), Google Chrome 76, Microsoft Internet Explorer 11, and Microsoft Edge 44. Notably missing is Apple’s Safari browser or security minded browsers such as Brave.
In the final report Internet Explorer 11 fared the worst, but all the examined browsers failed multiple criteria except for Firefox.
To save you a trip to Google translate, the notable failings identified in the report are:
- No master password to protect the built-in password manager (Chrome, IE, Edge)
- No option to turn off user telemetry collection (Chrome, IE, Edge)
- No built-in update mechanism (for IE – it relies on the external Windows Update)
- And finally on ‘organizational transparency’ Google Chrome was marked down for not fully explaining how Chrome Cleanup works and Microsoft for a lack of transparency on how SmartScreen functions.
Internet Explorer was also singled out for its lack of support for: Same Origin Policy, Content Security Policy and Sub-resource Integrity (although its replacement Microsoft Edge does support all of these)
“We were very impressed with the service, I will say, the vulnerability found was one our previous organisation had not picked up, which does make you wonder if anything else was missed.”
Aim Ltd Chief Technology Officer (CTO)