Firefox on Debian stable is so old that websites yell at you to upgrade to a newer browser. And last time I tried installing Debian testing (or was it debian unstable?), the installer shat itself trying to make the bootloader. After I got it to boot, apt refused to work because of a missing symlink to busybox. Why on earth do they even need busybox if the base install already comes with full gnu coreutils? I remember Debian as the distro that Just Wroks(TM), when did it all go so wrong? Is anyone else here having similar issues, or am I doing something wrong?
My bank used to complain that my browser was out of date. I wrote an email to customer service explaining to them that:
A) debian's "out of date" browser actually includes all up to date security patches. B) simply reading the browser agent isnt really security. I had simply been spoofing my browser agent to get around their silly browser "security" policy
They removed the browser check 2 weeks later. Not sure if it was because of me
It's not for their security, but for that of genuinely clueless people that are just running an actually outdated browser that might have known and exploitable security flaws.
It is not about security at all. They do not want to test or support old browsers. So, they set a minimum version and tell you that you need to upgrade to that.
If they only support one browser, it is going to be Chrome. Chrome has more zero-day vulnerabilities than any other project I can think of. It is not about security.
How do you know this? Of course there are lots of reasons for why they'd want to enforce minimum browser versions. But security might very well be one of them. Especially if you're a bank you probably feel bad about sending session tokens to a browser that potentially has known security vulnerabilities.
And sure, the user agent isn't a sure way to tell whether a browser is outdated, but in 95% of cases it's good enough, and people that know enough to understand the block shouldn't apply to them can bypass it easily anyway.
Yeah if it were about security they'd check the version of HTTPS, SSL, TLS and all that stuff.
Doing that would tell you nothing about whether the browser might have un-patched, known vulnerabilities elsewhere.