Puppy Linux Discussion Forum

Lobster · Posted: Wed 21 Oct 2009, 04:57 Post subject: Which browser is most secure?

Working on the next version of GROWL

Puppy Browser is enabled for javascript and flash - not so good for security Crying or Very sad

choices in 4.3.1 package manager include:
gtkmoz
netsurf
skipstone
Would Dillo2 (if available?) be better for security/banking/building worlds biggest net?
[ Embarassed

oops must not reveal secret Lobsterian phishing plans for increasing fish stocks] Wink

Which is the best of the small browsers for security?

trapster · Joined: 28 Nov 2005 Posts: 2113 Location: Maine, USA

I'm curious, is it only gui browsers that are security risks?
Where does lynx or elinks fit into this?

Lobster · Posted: Wed 21 Oct 2009, 07:59 Post subject:

lynx or elinks do not have javascript or Flash

Javascript is the only problem I have experienced
that is redirects or 'Clickjacking attacks'
You can turn off javascript with Monkeymenu
or Noscript
https://addons.mozilla.org/en-US/seamonkey/addon/722
- however these attacks are annoying more than anything
One did try and convince me that Windows was infected
I of course was not running Windows it was trying to sell
a product for a fault I did not and could not have (no Wine on my system even)

Adblock (part of 4.3.1) disables Flash
which can contain actionscript BUT I have never experienced problems with it

mikeb · Joined: 23 Nov 2006 Posts: 11143

The integration of internet explorer and other activeX controls on windows were the main catalysts for virus proliferation on the internet. The other route was having lan ports open to the net...135/137/139 (rpc and netbios/samba)
That's about it really...deal with that and life is much better.

mike

8-bit · Joined: 03 Apr 2007 Posts: 3425 Location: Oregon

I have an old laptop that dual boots Puppy 421 and Puppy 431.
It was setting idle with a black screen and no applications running.
It had a netlink USB wireless connection to the internet, but no browser running.
I noticed that the activity light on the USB wireless stick was flashing.
When I went to shut it down, just before the screen shut down with the computer, I noticed in the center of the screen a fleeting message.
All it said was "Keyboard Logger".
This is the first time I have ever seen anything like that.
I was also running Puppy 431 on the other computer that was connected to the router physically.
Is this anything to be concerned with?
Remember we are talking about 2 PCs running Puppy 431 here.

efiguy · Joined: 06 Sep 2006 Posts: 169

Hello 8-bit,

I too have noticed my network Icon flashing unexpectedly running Barry's early version, 431 (works fine for the tamed webserver app that I use it for and some browsing) have a download also from ttuuxxx website that is September update to try. Actually posting from Lighthouse in ram Puppy and found your post.

The harddrive version of 431 has Iptable mods and resists GRC probes, Cupsd is turned off. A base hardened Hiawatha is turned on, but there isn't any publication of its IP's and ports, but the PC sets directly off of a Linksys router.

I know that Windows is vulnerable to commercial keyloggers, and presume that Linux should also be, as it is so "network friendly", and the personal using it so much more capable of programming art.

I found a small linux a coupla days ago with a rootkit searching in the menu, it is called Insert-139B or close to that, maybe # is partially wrong,
Went to HD and found name to be INSERT-1.3.9b_en.iso

I booted it in ram, but it was so needful of command line guidance, that I personally could not use it.
As I type here, the network Icon of Lighthouse is inactive, as is the HD lights, I would have concern over your systems, maybe mine too

jay

PS edit,
A thought just occurred to me, reading all the posts on ttuuxxx link where members lament that so many pets have not been updated and errors are continued from puppy version to version, this is a way that mischief might be done, even if the "listener" on the "far end" is long gone - just a thought.
.

Lobster · Posted: Sat 20 Feb 2010, 06:13 Post subject:

Would you click on this browser link?
http://5z8.info/manhunter_b0c6w_nakedgrandmas.jpg

Shocked

Yep part of my 'don't fight the paranoia' campaign

nitehawk · Posted: Sun 21 Feb 2010, 12:58 Post subject:

OK,...Netsurf and Slipstone don't have (am I right?) java or flash? I've used Midori (I likey)....but it has flash enabled (not java, though). But don't a lot of the banking (I'm thinking PayPal, too) require the use of java and/or flash? For instance,..even when I use the very latest FireFox,..my bank's "secure" website fusses at me for not using IE!!! (Firefox works, though,..just don't know how secure it really is...and the banking website has some stuff that only work with java).

DMcCunney · Joined: 02 Feb 2009 Posts: 894

xman · Joined: 24 Sep 2009 Posts: 144

Lobster · Posted: Wed 05 May 2010, 03:46 Post subject:

Access all areas - go to all URL's
http://lifehacker.com/5516305/top-10-ways-to-access-blocked-stuff-on-the-web

xman · Joined: 24 Sep 2009 Posts: 144

Are you experiencing your browser unstable? Have you Java? Is your Java up to date? Many questions, but there is a reason for them. The number of Java exploit attempts increased sharply in summer (http://blogs.technet.com/b/mmpc/archive/2010/10/18/have-you-checked-the-java.aspx).

Lobster · Posted: Tue 19 Oct 2010, 15:51 Post subject:

http://puppylinux.org/wikka/JavaRuntimeEnvironment

Coolpup has just repackaged java
Midori in Lucid 5.2 warns that it may be a security risk if used as
a connect to web browser (it is used internally as a HTML reader)
- is it a risk? Can it be hardened?
What about Iron (secure Chrome) 2 versions are available in the
Lucid 5.2 package manager - check it out
http://en.wikipedia.org/wiki/SRWare_Iron

Check them all with Wireshark
http://murga-linux.com/puppy/viewtopic.php?p=111787#111787

Lobster · Posted: Mon 31 Jan 2011, 23:53 Post subject:

900 million IE users compromised
http://www.bbc.co.uk/news/technology-12325139

ttuuxxx · Posted: Tue 01 Feb 2011, 18:32 Post subject:

I would say the latest Firefox 4, without flash and java. Firefox is updated 10 to 1 compared to Seamonkey, the guys at Seamonkey just monkey around most the time, lol
I don't think any other browser is updated/patched and tested for security leaks as much as Firefox.
ttuuxxx