Yes, it's true: The updated version of Microsoft Internet Explorer (IE) 6.0 in Windows XP Service Pack 2 (SP2) is a lot more secure than earlier IE versions were. But, for a variety of reasons, some people can't upgrade to XP SP2. If you're one of those people, what can you do to improve Web browsing security? You can use an alternative browser, such as the Mozilla Organization's Firefox 1.0, until you can upgrade.
Firefox is an excellent solution. It's lightweight and offers a multitude of useful features, including pop-up blocking, plug-in control, extension control, advanced cookie control, advanced software-installation control, advanced download control, NT LAN Manager (NTLM) authentication, automatic software updates, quick turnaround for security patches, and much more.
After you review Firefox's features, I think you'll agree that it deserves serious consideration as a way to boost Web browsing security on the desktop and server in lieu of XP SP2. Plus, Firefox is open-source software and is freely available to everyone.
Authentication
Many Web sites that are based on Microsoft IIS use NTLM with a Web browser to authenticate to Windows-based systems. For example, your Web content management interface or specific Web-based applications might require NTLM authentication, particularly on your intranet. During earlier phases of its development, Firefox didn't support NTLM authentication, but during its evolution the developers added NTLM support, better positioning the browser as a viable IE alternative. Keep in mind that Firefox's NTLM authentication isn't completely transparent; the browser displays a dialog box that you use to enter your username and password.
For other types of secure communication that require authentication, Firefox currently supports Secure Sockets Layer (SSL) 3.0, SSL 2.0, and Transparent LAN service (TLS 1.0) and has a built-in certificate-management system that uses content revocation lists and the Online Certificate Status Protocol (OCSP) to validate certificates. Firefox also has built-in support for security devices, such as smart cards, that secure communications often use for authentication.
Plug-ins and Extension Management
The updated IE 6.0 supports a new add-on manager that lets you control whether to enable add-ons. Firefox calls add-ons plug-ins and typically adds support for third-party content (e.g., Adobe Acrobat PDF files, Apple Computer Quicktime movies). Firefox also has a plug-in manager that lets you enable or disable plug-ins and whatever action a given plug-in performs. You can also improve Firefox's functionality by adding extensions. For example, you can add the IE View extension, which adds a link to your pop-up menus that opens a given URL in IE instead of Firefox if that site requires IE. The extension manager lets you update installed extensions.
Firefox lets you enable or disable extensions and plug-ins entirely or selectively. When you visit a Web site that offers an extension to Firefox and extension installation is turned off, Firefox displays a message at the top of the Web page that alerts you that extensions are turned off.
When you select Tools, Edit Options, the Options dialog box displays the Web Features option; you can select Allow web sites to install software and click Allowed Sites to define which sites you'll allow to install software. When you visit a site that displays the message that Figure 1 shows in the message bar, you can click Edit Options (to the right of the message) and easily add the site to the Allowed Sites list.
Figure 2 shows the message Firefox displays when you've enabled the Allow web sites to install software option but haven't defined any sites in the Allowed Sites list. When you click Edit Options, the Allowed Sites dialog box displays the Web site address, which you can add by clicking Add.
To manage browser extensions that you've already installed, select Tools, Extensions to open the Extensions dialog box that Figure 3 shows. The dialog box lets you uninstall extensions, update extensions, configure options for a given extension if the extension has such options (some extensions don't), and click a link that opens the Mozilla Web site, which, at the time of this writing, contains more than 160 popular extensions. You can quickly add new extensions with a few mouse clicks.
To manage browser plug-ins such as Adobe Acrobat Reader, select Tools, Options, Downloads, and click Plug-ins, which displays a Plug-Ins dialog box like the one that Figure 4 shows. You can control which plug-ins to enable for which file types by clicking the dot next to file type under Enabled. Checkmarks mean the plug-ins are enabled, and dots mean the plug-ins are disabled. When you download plug-ins and extensions, Firefox displays a dialog box that tells you whether the plug-in is cryptographically signed, so you can choose whether to install the plug-in or extension if you feel uncertain about its authenticity.
Blocking Unwanted Pop-Ups
You can use the Firefox pop-up manager (under Tools, Options, Web Features) to selectively configure which sites can display pop-ups by entering the URL of the site for which you want to allow or block pop-ups. You can configure Firefox to block all pop-ups by default but allow pop-ups from sites you select.
When a site tries to open a pop-up window that you want blocked, Firefox displays the message that Figure 5 shows. You can click anywhere on the message bar for a drop-down menu that lets you quickly adjust pop-up settings. The menu options include the ability to disable the pop-up warning notice bar, edit overall pop-up manager settings, allow pop-ups for the domain you're visiting, and display selected pop-ups from the site you're visiting.