Manuel Caballero, a security researcher, documents browser vulnerabilities in Internet Explorer and Edge, such as SOP bypass and address bar spoofing.
Commenters cite it for Edge and IE bugs such as referrer spoofing, as evidence that browser flaws undermine origin-based protections.
Yes, this exactly. If anyone cared to check out the advanced configuration it is pretty much exclusively turning off security vulnerabilities.
One of them is "Automatically trust WiFi connections my contacts trust", a bunch of others are sending data to Microsoft. It's been a few months since I turned on a new Windows 10 PC but I was completely turned off by the advanced configuration.
The #3 story on HN right now is "Windows 10 in-place upgrades are a severe security risk"
I thought this was a good read the other day https://www.brokenbrowser.com/abusing-of-protocols/
It just seems terrible security wise, the OS itself is spyware.
That is to say, I was excited to be trying out a sexy new Asus Ultrabook with Ubuntu mixed in but didn't care to try after setting it up.
I used to prefer the origin/referer approach to blocking CSRF because it can be done upstream of the application server (or in a middleware), transparent to developers who often get these things wrong.
However there's been enough referer spoofing browser bugs lately that I'd rather have the extra safety (and complexity) of CSRF tokens. Just 3 months ago Edge had (another) referer spoofing bug:
https://www.brokenbrowser.com/referer-spoofing-patch-bypass/
Edge is not a good browser. It is holding the web back with its slow adoption of HTML5 standards. (source: https://html5test.com/compare/browser/chrome-58/edge-12.html)
Edge still has a spoof referrer header vulnerability that's been known for more than 6 months now: https://www.brokenbrowser.com/referer-spoofing-patch-bypass/