Chrome only browser left standing after day one of Pwn2Own

http://arstechnica.com/security/news/2009/03/chrome-is-the-only-browser-left-standing-in-pwn2own-contest.ars

by jlhamilton • 17 years ago

36 15 17 years ago

tptacek3• 17 years ago

On the other hand, Chrome is the browser security researchers know the least about; it's not an apples-to-apples comparison, yet.

biotech• 17 years ago

There are a couple other points, though:

- Chrome is only available for Windows ATM. Windows boxes are apparently more difficult to crack than Macs.

- Chrome runs in a sandbox, unlike IE or Safari, which adds some security as well.

tptacek3• 17 years ago

Chrome sandboxing doesn't rely on things like address space randomization and NX, so the Mac vs. Win32 different --- while probably still present --- may be less pronounced.

ntyntyesr• 17 years ago

Comparing mobile browsers they ignored Opera - the most common mobile browser and the most secure.

j2d2• 17 years ago

Do you think it's more common than safari on iphone? Do you have any way to verify that?

tptacek3• 17 years ago

I have no idea why you think Opera is the most secure mobile browser.

TimothyFitz• 17 years ago

Guessing this is a symptom of: Tiny market share Radically different approach to security (heavy sandboxing, multi-process)

We don't yet know if Chrome is actually more secure.

stcredzero• 17 years ago

I'd bet that it is. I can't think of a fair way to adjudicate that, though.

axod• 17 years ago

>> "after day one"

Isn't this all a big theatre type thing anyway? Aren't exploits prepared well in advance anyway?

It'd be a more interesting competition if the competitors were given never before seen new versions of browsers, and asked to crack them on the spot.

secres• 17 years ago

Since the rules change (i.e. become easier) each day, the day number gives you some indication of the relative difficulty in performing the exploit, even though the exploits themselves are prepared in advance:

http://cansecwest.com/post/2009-03-18-01:00:00.PWN2OWN_Final...

drawkbox• 17 years ago

As soon as all extensions are ported there is no reason not to use Chrome.

natmaster• 17 years ago

"Windows, on the other hand, he claims is tougher because of its address randomization feature and other security measures. As for Chrome, he says that he has identified a security bug in Google's browser but has been unable to exploit it because the browser's sandboxing feature and the operating system's security"

Sounds like Chrome was saved by not having a version for the extremely vulnerable Mac. Security by obscurity is no security at all.

simonw• 17 years ago

Isn't address randomization a form of security by obscurity?

Chrome only browser left standing after day one of Pwn2Own

Related Stories