The most SECURE browser?

Browser tests. Mostly they just check that plugins are up to date rather than simulate exploits.

Here's a few that do more. Screenshots posted so that results can be compared.

check-and-secure | powered by cyscon GmbH! (Warning. Will offer to install HitmanPro Alert. Maybe you don't want it).

Feature Settings Check - Main - Not really a browser check. Checks to see if your security blocks harmless malware test samples.

BrowserSpy.dk - aimed at testing privacy.

Zeigen's Referrer Test referrer test



PC Flank: Make sure you're protected on all sides. - lots of stuff

https://www.ssllabs.com/ssltest/viewMyClient.html SSL/TLS test (Ciphers test)



https://www.howsmyssl.com/ Another SSL test



https://panopticlick.eff.org/index.php - Browser Fingerprinting



https://www.grc.com/dns/dns.htm - DNS Nameserver Test

Test for X-FRAME-OPTIONS - Click-jacking test



As for IE - I don't want to knock it. It does well if configured correctly but that's the hard bit! I've never found a way to selectively allow flash content rather than allowing flash to run for the whole page.

Domains and IP's blocked:

carwiz said:

Let me ask you something. How many entries do you have in your Host file? That will tell me how concerned you are about security. How many sites do you allow to use Flash? Are you using a 64-bit browser? Do you have enhanced security turned on? Do you have Windows Firewall turned on? How many entries have you put in the firewall?

Most answers to these questions will be; zero, all, don't know, what's that and who cares. Then they will complain that IE or Windows is unsafe. Yeah, right.

I wrote an email to WhiteHate Aviator support to get clarification for the sake of this thread. My email is as follows:

Hello,

I have tried out your browser which was recommended to me on a forum that i started HERE and honestly, so far, i love it.

I am wanting to get information on what Aviator supports and what it does not. Such as "ASLR" and which versions of "TLS" do you guys support and which one is enabled by default?

My goal is to find a browser that is secure out of the box with minimal configuration required. I thought Aviator was AWESOME until people started talking about IE11 and how secure it is on that forum blah blah blah (then again it is SevenForums so people being in favor or IE11 is to be expected)

Please give me some information to add to that t possibly convert them to Aviator, LOL.

Also, do extensions that work in Chrome such as Zenmate and Adblock work just like they would in Chrome? I think its awesome that you already add Disconnect because thats what i was using in addition to the other two i mentioned while i was still using Chrome. Also, can adding these extensions to White Hate Aviator effect it's security? Say for instance, Zenmate has a newly found exploit and someone tries to use it on me.



P.S.

Any recommendations on settings that I can configure in order to make Aviator even MORE secure than it already is? And maybe some type of "Benchmark" site recommendation to calculate the security of the browser compared to others?


Their reply is as follows:

Hi,

Thanks for the questions! I’ll take them one at a time:

- Aviator in terms of security support is similar to Chrome due to the shared Chromium source. That means it supports ASLR, DEP and TLS 1.0, 1.1 and 1.2. Due to the click-to-play that’s standard on Aviator for Flash and Java, the drive by downloads that compromise these systems are drastically reduced in effectiveness for the average user.

- Yeah I can see a Windows oriented forum being a bit biased towards IE. Just a bit.

- Extensions for the most part work with Aviator just as they would in Chrome. Adblock definitely works for Aviator (though there’s a native adblock built in to Aviator), and even though a customer has told me they couldn’t use Zenmate, it’s worked just fine for me. Extensions that can be incompatible are some password managers which require a check of the browser type before working with it (1Password is like this, though we are in the process of getting approved) and some that don’t work in incognito mode in Chrome won’t work in Protected mode in Aviator (since this is the default mode in Aviator it decreases the effectiveness of these extensions) among others types. Exploits in terms of extensions seem to be limited to the permissions granted to the extension. So if you give an extension access to cookies or history, then those are at risk with the extension if it is exploited.

- For an increase in security, you can keep in mind that Aviator’s settings are designed to be a strict as can be allowed without drastically affecting the browsing experience. If you want to crank up Aviator from “Secure and Accessible” to “Ungodly levels of Security” the options to do that are in place in terms of things like preventing javascript, flash and cookies entirely, bulking up on the standard security and privacy extensions (HTTPS Everywhere, avast!, VPNs) and generally just an increase in awareness and good habits in browsing (regularly closing Aviator, caution on unknown sites, etc). There are tons of ways to ensure even more security and privacy, the only real limit is how much convenience and effort are you willing to sacrifice really.

- As for browser bookmark sites; despite being a person who, you know, works for a browser I don’t really have any good suggestions outside of the usual acid or html5-compatibility tests that a quick search will show are pretty common. I don’t know if there’s any legitimate sites that could do security/privacy testing in such an acceptable way that I could recommend here, but there very well could be some out there unbeknownst to me.

I hope this answers your questions, if I missed anything let me know and I’ll try to cover it. And if you have any others, please don’t hesitate to let us know!

Well for those tests I used Cyberfox 28.0.1 64bit AMD optimized version but it's been tweaked a lot (via preferences) and also uses add ons for certain stuff. For example javascript is enabled but can't be detected by Panopticlick and the user agent is randomised. So it's not really a true "out of the box" test.

I don't limit myself to one single browser either!

And that TLS stuff - I used the Powershell script here:

How to fix SSL 2.0 and BEAST on IIS - Information Security Stack Exchange

And the reg files attached here:

Changing IE's SSL cipher order | Wilders Security Forums

That takes care of windows but also had to configure browsers to disable weak ciphers.

Well you can manually change the user agent string in Aviator by right clicking the Aviator shortcut and adding the user agent in the target box. So if you add:



--user-agent="Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)"

including the space before -- ,then sites will identify the browser as IE8 but it might cause some features on the site not work correctly.





It does seem to be pretty secure in so far as that without any plugins installed there shouldn't be a problem!

How can you make your browser more secure? Well whatever browser you use, keep plugins updated, keep the browser updated and if possible try to configure it securely. Then use a secure DNS Nameserver.

As for other browsers like Cyberfox - it's a Firefox variant, you can change the user agent string or use an add ons like User Agent Switcher or User Agent Cleaner plus a few others.