Which Browsers Are The Most Secure?

[Renk]

Do a test here.

It's a "suite of security tests that measure whether the browser supports JavaScript APIs that allow safe interactions between sites, and whether it follows industry best practices for blocking harmful interactions between sites".
Security - What are the Security Tests? - Browserscope

You can then compare your results with those of the main browsers.

Spoiler The safest:

You can see the good results FF gets. Chrome 8 seems the safest of all, but it's only in assuming that you can be safe in the middle of Google's tentacles. Anyway as usual FF can easily get better: It seems FF 4 beta6 with noscript "scripts globally allowed" enabled has a higher score than Chrome 8.

Spoiler The unsafest:

You can contemplate here the weak score 10.63 Opera's browser gets. IE8 itself seems even better. Poor Opera users are really living in an insecure world....

NB: Some trolls-like sentences are included in this thread. Will you able to find them ?

[anon]

My score:

Spoiler Click >>>:

1. PASS postMessage API
2. PASS JSON.parse API
3. FAIL toStaticHTML API
4. PASS httpOnly cookie API
5. PASS X-Frame-Options
6. FAIL X-Content-Type-Options
7. FAIL Block reflected XSS
8. PASS Block location spoofing
9. PASS Block JSON hijacking
10. PASS Block XSS in CSS
11. FAIL Sandbox attribute
12. FAIL Origin header
13. FAIL Strict Transport Security
14. PASS Block cross-origin CSS attacks
15. FAIL Content Security Policy
16. FAIL Cross Origin Resource Sharing
17. PASS Block visited link sniffing

Can't comment on the troll-like sentences.

Is there any browser that passes all the checks?

[piratemeister]

1. PASS postMessage API
2. PASS JSON.parse API
3. FAIL toStaticHTML API
4. PASS httpOnly cookie API
5. PASS X-Frame-Options
6. FAIL X-Content-Type-Options
7. FAIL Block reflected XSS
8. PASS Block location spoofing
9. PASS Block JSON hijacking
10. PASS Block XSS in CSS
11. FAIL Sandbox attribute
12. FAIL Origin header
13. FAIL Strict Transport Security
14. PASS Block cross-origin CSS attacks
15. FAIL Content Security Policy
16. PASS Cross Origin Resource Sharing
17. FAIL Block visited link sniffing

[SealLion]

Here is my result of the test

1. PASS postMessage API
2. PASS JSON.parse API
3. FAIL toStaticHTML API
4. PASS httpOnly cookie API
5. PASS X-Frame-Options
6. FAIL X-Content-Type-Options
7. FAIL Block reflected XSS
8. PASS Block location spoofing
9. PASS Block JSON hijacking
10. PASS Block XSS in CSS
11. FAIL Sandbox attribute
12. FAIL Origin header
13. FAIL Strict Transport Security
14. PASS Block cross-origin CSS attacks
15. FAIL Content Security Policy
16. PASS Cross Origin Resource Sharing
17. FAIL Block visited link sniffing

---------- Post added at 12:34 ---------- Previous post was at 12:33 ----------

Pretty much the same as TheDeathless results.

[slikrapid]

1. PASS postMessage API
2. PASS JSON.parse API
3. PASS toStaticHTML API
4. PASS httpOnly cookie API
5. PASS X-Frame-Options
6. PASS X-Content-Type-Options
7. PASS Block reflected XSS
8. PASS Block location spoofing
9. PASS Block JSON hijacking
10. PASS Block XSS in CSS
11. FAIL Sandbox attribute
12. FAIL Origin header
13. PASS Strict Transport Security
14. PASS Block cross-origin CSS attacks
15. FAIL Content Security Policy
16. PASS Cross Origin Resource Sharing
17. FAIL Block visited link sniffing

13/17, as expected for firefox

[piratemeister]

I'm using FireFox on Ubuntu 10.10 with all updates.

[slikrapid]

firefox version 3.6 (9/17) vs. 3.6.12 (13/17), let me guess: you haven't restarted it recently

[piratemeister]

My version is 3.6.12 how is possible our result are different ?

[slikrapid]

i also use Adblock Plus & NoScript add-ons, maybe thats the reason why

[piratemeister]

Also I use adblock plus. No I will try NoScript (Is also made in italy ) and post my result.

---------- Post added at 21:15 ---------- Previous post was at 21:12 ----------

1. PASS postMessage API
2. PASS JSON.parse API
3. PASS toStaticHTML API
4. PASS httpOnly cookie API
5. PASS X-Frame-Options
6. PASS X-Content-Type-Options
7. PASS Block reflected XSS
8. PASS Block location spoofing
9. PASS Block JSON hijacking
10. PASS Block XSS in CSS
11. FAIL Sandbox attribute
12. FAIL Origin header
13. PASS Strict Transport Security
14. PASS Block cross-origin CSS attacks
15. FAIL Content Security Policy
16. PASS Cross Origin Resource Sharing
17. FAIL Block visited link sniffing

13/17

[SealLion]

I guess mine's a little bit better now. Thanks slik for the comment suggesting that No Script might be the detail involved.

1. PASS postMessage API
2. PASS JSON.parse API
3. PASS toStaticHTML API
4. PASS httpOnly cookie API
5. PASS X-Frame-Options
6. PASS X-Content-Type-Options
7. PASS Block reflected XSS
8. PASS Block location spoofing
9. PASS Block JSON hijacking
10. PASS Block XSS in CSS
11. FAIL Sandbox attribute
12. FAIL Origin header
13. PASS Strict Transport Security
14. PASS Block cross-origin CSS attacks
15. FAIL Content Security Policy
16. PASS Cross Origin Resource Sharing
17. FAIL Block visited link sniffing

I guess I now have the same results as yourselves. :)

[tokiodrift1]

1. PASS postMessage API
2. PASS JSON.parse API
3. PASS toStaticHTML API
4. PASS httpOnly cookie API
5. PASS X-Frame-Options
6. PASS X-Content-Type-Options
7. PASS Block reflected XSS
8. PASS Block location spoofing
9. PASS Block JSON hijacking
10. PASS Block XSS in CSS
11. FAIL Sandbox attribute
12. FAIL Origin header
13. PASS Strict Transport Security
14. PASS Block cross-origin CSS attacks
15. FAIL Content Security Policy
16. PASS Cross Origin Resource Sharing
17. PASS Block visited link sniffing

14/17
_____

---------- Post added at 00:21 ---------- Previous post was at 00:20 ----------

ff, latest stable.

[SealLion]

17. PASS Block visited link sniffing

tokio, how did you manage to get this as a pass and we got ours as a fail??

[Instab]

   1. PASS postMessage API
   2. PASS JSON.parse API
   3. PASS toStaticHTML API
   4. FAIL httpOnly cookie API
   5. PASS X-Frame-Options
   6. PASS X-Content-Type-Options
   7. PASS Block reflected XSS
   8. PASS Block location spoofing
   9. PASS Block JSON hijacking
  10. PASS Block XSS in CSS
  11. FAIL Sandbox attribute
  12. FAIL Origin header
  13. PASS Strict Transport Security
  14. PASS Block cross-origin CSS attacks
  15. FAIL Content Security Policy
  16. PASS Cross Origin Resource Sharing
  17. PASS Block visited link sniffing

also the test requires js which i have disabled by default normally

[illusive]

1. FAIL postMessage API
2. FAIL JSON.parse API
3. FAIL toStaticHTML API
4. FAIL httpOnly cookie API
5. FAIL X-Frame-Options
6. FAIL X-Content-Type-Options
7. FAIL Block reflected XSS
8. PASS Block location spoofing
9. FAIL Block JSON hijacking
10. PASS Block XSS in CSS
11. FAIL Sandbox attribute
12. FAIL Origin header
13. FAIL Strict Transport Security
14. FAIL Block cross-origin CSS attacks
15. FAIL Content Security Policy
16. FAIL Cross Origin Resource Sharing
17. FAIL Block visited link sniffing

I'm using FireFox 1.5.0.4