Security experts often advise users to use more than one
browser: one for surng the wild web and others for visit-
ing sensitive" web sites, such as online banking web sites
[1, 2]. This advice raises a number of questions. Can us-
ing more than one browser actually improve security? If
so, which properties are important? Can we realize these
security benets without resorting to the use of more than
one browser?
In this paper, we seek to answer these questions by crystal-
lizing two key security properties of using multiple browsers,
which we refer to as entry-point restriction and state isola-
tion. We nd that these two properties are responsible for
much of the security benet of using multiple browsers, and
we show how to achieve these security benets in a single
browser by letting web sites opt in to these behaviors.
Consider a user who diligently uses two browsers for secu-
rity. This user designates one browser as sensitive" and one
as
on-sensitive". She uses the sensitive browser only for
accessing her online bank (through known URLs and book-
marks) and refrains from visiting the general Web with the
sensitive browser. Meanwhile, she uses only the non-sensitive
browser for the rest of the Web and does not use it to visit
high-value sites.