This page lists some information on old security holes discovered in the Netscape browser. It used to be a part of the randomness resources page for our Dr. Dobb's Journal article. See also this page for some more information on the attack we described in our the article.

The following attacks are no longer news, and the list of security holes is now out of date and incomplete. Furthermore, this information wasn't central to the randomness resources page. For these reasons, they have been moved here to their own page (mostly for archival purposes).

Information about attacks on Netscape

• Damien Dologez's brute force attack
• Adam Back, David Byer, and Eric Young's brute force attack
• Third (and fastest!) brute force attack (many contributors)
• Our randomness attack
• Hack Netscape: Community ConneXion's challenge, with success stories
• Don Davis describes a little-known attack at the end of his paper; see full citation and abstract
• Drew Dean and Dan Wallach show a bug in Sun's HotJava implementation
• Scott Weston finds a bug in Netscape 2.0b2's LiveScript
• Paul Kocher explains how to attack implementations of public-key cryptosystems; applicability to Netscape is not entirely known.

Relevant Netscape press releases

• Overview of Netscape security
• Response to brute force attack
• Response to our attack
• Fix for our attack
• Bugs Bounty offer