Firefox is a Web browser that is smaller, faster, and in some ways more secure than the Netscape browser from which much of its code was derived.

learn more… | top users | synonyms

0
votes
0answers
54 views

Browser Autopwn2 Unable to exploit Firefox 47.0.1

Virtual Appliance: VMWare Workstation 12 Player Local VM: Kali Linux 2 Remote (Victim) VM: Windows XP Browsers on Remote VM: Firefox 47.0.1, IE 6 This article explains Browser Autopwn2 exploit. I ...
1
vote
1answer
64 views

How secure is the native browser password autofill?

Safari, Chrome, Firefox, Edge, and IE all either have a suggest-password feature, or password archival feature. How secure are these passwords when stored on a computer? If replicated, how secure ...
0
votes
1answer
49 views

Script injection on all browsers

I have something injecting a script into all web browsers that I have tried - Firefox, IE, Edge, Chrome - and it doesn't look like an extension (since it is doing so in different web browsers). I ...
1
vote
4answers
2k views

Are these “Urgent Firefox Update” popups bogus?

I've gotten, over the past couple of weeks, at least three screens popping up saying "Urgent Firefox Update". These are from URL https://eexowdlzyjx.net/. At least once they have been preceded by "...
0
votes
4answers
66 views

Random pop ups caused by add on in Firefox

I'm a bit conflicted. Firefox was open to it's default home page and after a few minutes of inactivity a new tab opens by itself to this (seemingly harmless) webpage: http://barisderin.com/?p=2264 ...
0
votes
1answer
45 views

Firefox refuses to use X509 certificate, complaining “Cound not verify this certificate for unknown reasons”

I stumbled upon this question and answer. I have the same problem as the OP, and am sorry to report that the proposed answer does not resolve it. Certificate in question has been verified by OpenSSL-1....
4
votes
1answer
49 views

Does Firefox use OCSP?

And if it does use Online Certificate Status Protocol, is there a way to disable it, so that it uses CRL instead?
1
vote
0answers
36 views

How to change system fonts list in Firefox to avoid browser fingerprinting? [closed]

I found solution for most of types of browser fingerprints: IP - ZenMate Firefox VPN Add-on Canvas - CanvasBlocker Add-on Timezone - I use AutoIt to change Windows Timezone List of PlugIns - I just ...
2
votes
1answer
98 views

How to force Firefox to remember passwords?

I use 32-character (128-bit) randomly generated passwords. It's a little bit hard to remember them all, so I use encrypted keyring built into firefox. In this way I have different passwords to ...
1
vote
2answers
98 views

Can I trust browsers not to snoop into my activities?

Is there anything stopping web browsers from snooping into our activities? I don't mean web history or any of that generic stuff (Chrome already collects them, right?), but is it technically possible ...
15
votes
1answer
184 views

Preventing a site from appearing in the 'Most Visited' or 'speed dial' section of a web browser

Are there any established ways of preventing a website from appearing as an icon on the 'Most Visited' / 'Speed dial' / start page of a web browser? One example of this is the tab that opens by ...
0
votes
0answers
25 views

How to check Firefox CA health?

If we have a RHEL based desktop at a workplace, how can we check the health of the Certificate Authorities trusted by Firefox? I mean: The list that which CA is allowed in the webbrowser And that ...
1
vote
1answer
132 views

Firefox security certificate issues: FUD or truth?

I was doing a little reading over at gHacks, and came across this comment attributed to Joey Spinosa regarding certificates in Firefox: These certificates are installed automatically by the ...
7
votes
2answers
225 views

Why does Mozilla Firefox encrypt saved passwords?

If you ask Mozilla Firefox to remember the login details for a website, the credentials will be stored in your profile directory in Logins.json. Instead of storing plaintext values, the username and ...
0
votes
1answer
62 views

Strange symbols in Firefox address bar with https

Why are there dash marks through the https portion of this address? Is this a feature that's supposed to further accentuate that this is unsecured https? I just thought it was a graphical glitch ...
0
votes
2answers
49 views

Using specific firefox profile of Tor instead of Torbrowser

I create a dedicated profile in Firefox for tor (with firefox -no-remote -p) and configure it to use specific network setting with Edit > Preferences, Advanced > Network > Settings And then: manual ...
9
votes
1answer
261 views

Is NoScript bad? [closed]

I just came to know about NoScript, but after installing it opened the author's homepage with an advert for 'SpeedUpMyPC' that pointed to a UniBlue website, which I found fishy. Googling turned up ...
4
votes
1answer
149 views

Can canvas fingerprinting be prevented?

How can canvas fingerprinting be prevented in web browsers? The site Panopticlick said I had a hash of WebGL fingerprint of 5 bits of entropy. I installed CanvasBlocker addon and tested again and it ...
1
vote
2answers
167 views

Why won't Firefox accept my certificate?

I've been trying to get stunnel to work with my signed certificate (with a CA that I've trusted in Firefox). The error is: 127.0.0.1:5559 uses an invalid security certificate. The certificate is ...
1
vote
1answer
105 views

Should VPN passwords be stored in plaintext?

I know nothing about setting up a VPN, but it happens that I use a VPN add-on for Firefox, and that the VPN provider stores the user password in plaintext. Last week I installed a VPN add-on for ...
36
votes
4answers
4k views

Avast AV could read Firefox saved passwords

My friend uses Firefox's built-in password manager feature to save passwords for sites. Later, after installing Avast Free Antivirus there was a feature called Passwords on the Avast UI. When accessed ...
4
votes
2answers
90 views

Why would a modern browser allow internal resources to be loaded from an external page

Recently someone announced that several Arris surfboard models lacked any form of authentication to perform functions such as reboot and factory reset a modem with a single http call. Read more on ...
4
votes
1answer
45 views

Can going to a bad website on firefox, or installing a malcious firefox plugin, infect other parts of my home folder on a Linux system?

BTW, I don't mean root, just a plain user. I'm worried because I'm scared that if I do such things I could infect my Chromium folder. I got a huge case of OCD.
7
votes
1answer
1k views

Why does Firefox claim that my connection to Google is insecure?

I keep receiving this message whenever I open any site from Google: My Firefox is up-to-date, and so my Windows 8.1. Since I don't know much about HSTS, I don't know what's going on, and obviously, ...
3
votes
1answer
175 views

Firefox & Chrome Strong Ciphers

Of the following ciphers for RSA authentication, Firefox and Chrome do not use stronger than ECDHE-RSA-AES128-SHA256. ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(256) Mac=AEAD ...
64
votes
13answers
9k views

Should I allow browsers to remember my passwords and synchronize them?

I wonder, how wise is it to allow Chrome and Firefox to a) remember the passwords b) synchronize them? My gut tells me that if it's not man in the middle who can intercept them, but Google and Mozilla ...
1
vote
1answer
62 views

HTTPS Everywhere (Firefox) allows mixed content on pages with images

I use HTTPS Everywhere extension for Firefox, and recently I've started witnessing Mixed Content warnings from time to time, apparently when there are images with http:// prefixes (in particular at SE ...
1
vote
1answer
77 views

Does using Ghostery with Privacy Badger impair PB's heuristic learning?

I am running Ghostery and Privacy Badger for FF. From what I have read at eff.org/privacybadger, PB uses a heuristic algorithm to learn what 3rd-party sites are tracking me. If I am running Ghostery ...
5
votes
1answer
245 views

What kind of information is exposed during a Firefox private browsing session?

I'm working with Firefox 43.0.1 on Windows 7 Pro 64 bit. I just noticed an odd behavior, and I don't think Firefox used to behave this way. I had a GMail tab open in private browsing mode, and then ...
22
votes
7answers
2k views

How trustworthy is Firefox? [closed]

I looked at different password managers, to swap my user-generated, more or less predictable passwords for automatically generated, secure passwords. I stumbled upon KeePass and FeeFox (for Firefox ...
0
votes
1answer
234 views

Is firefox disabling of insecure TLS fallback part of the HSTS spec?

I've been looking into HSTS, and I can see that Firefox has supported it since version 4, but I can also see that you could click through untrusted cert browser warnings until Firefox 37. Is the ...
3
votes
0answers
267 views

Untrusted connection when logging to stack exchange sites

I was able to log into various stack exchange sites with no problem, but as of today 1/5/2016 I'm getting the following error message with firefox 43.0.2: You have asked Firefox to connect ...
0
votes
0answers
36 views

Persona private key storage?

Following the Q&A here, I have a few remaining questions: I am still confused about whether the could be any local access from a malicious browser extension to this shimmed private key or not? ...
0
votes
0answers
25 views

Is there any extra validation that Firefox perform to certificates serial number

I open a secured site in my computer. for my reasons, I created new certificate every 15 minutes. I noticed that, sometimes, Firefox "doesn't like" my certificate. after little investigation, I ...
4
votes
1answer
1k views

How to read the key3.db file?

The file key3.db contains the key that is used to encrypt the Firefox passwords stored in logins.json file. I don't use master password in Firefox, but according to this article, my passwords are ...
22
votes
1answer
1k views

How does Firefox encrypt passwords without selecting Master Password?

I know that the file logins.json contains all my encrypted passwords in Firefox browser. How does Firefox encrypt these passwords if I don't use the 'Master Password' option? Does this mean key3.db ...
7
votes
1answer
2k views

How to make Firefox ignore the X-XSS-Protection response header?

I have two questions: How can I make Firefox ignore the X-XSS-Protection header? I have a website which sends an X-XSS-Protection: 1 header and I want my Firefox to ignore that header, because it ...
0
votes
2answers
62 views

Analyzing whether browser certificates have been compromised

How can I know that my installed certificates (in Firefox), are (still) reliable?
8
votes
3answers
746 views

Why do Firefox and Chrome “leak” critical security information out of the browser and how can I stop it?

In studying SSL / TLS handshakes and encryption, I found a method that describes how to export the SSL / TLS session keys from Firefox to an user or environmental variable outside the browser, and ...
1
vote
1answer
99 views

How to determine which Browser Certs to reenable on a per-case basis?

Considering that there is no way to actually see which certs that I use in my regularly-visited websites, I've decided to disable all certs and re-enable them on a case by case basis. This is for the ...
4
votes
1answer
58 views

Does using creating a seprate firefox profile cause a seprate security context protect against XSS and DNS Re-binding?

I read here that I should use separate security profiles for different sorts of things; accessing sensitive information, doing system administration vs. opening links from emails. I know that ...
6
votes
1answer
447 views

Is mega.co.nz using my Browser for cracking passwords?

recently i found on my Firefox Profil, under .../storage/.../idb/ a File named "https+++mega.co.nz", i looked inside those files, some are encrypted (couldnt read it in Notepad++), but i found 27 ...
4
votes
2answers
168 views

How is HSTS handled on subdomains?

I recently audited a website with three hosts: the main site (example.com), and two subdomains (let's call them portal.example.com, and welcome.example.com). According to the response headers, HSTS ...
0
votes
0answers
20 views

Sites to test login through jmeter [duplicate]

Im having a hard time looking for a site with a login system that can be probed with firebug, the POST request password specifically, i was just wondering if anyone here knows one or two sites that ...
2
votes
1answer
125 views

Chrome/FF not negotiating advanced ciphers?

Ran into a weird problem trying to lock down our AWS ELBs today, specifically trying to deprecate all support for SHA-1. Having removed options like AES256-SHA ECDHE-RSA-AES256-SHA (among others) ...
27
votes
3answers
6k views

Firebug appears to be decrypting SSL traffic: is it the correct behaviour?

In my company we were writing a small web application which would be hosted and tested under HSTS protocol. One of my tester complained that the username and password can be seen in cleartext so it ...
2
votes
1answer
191 views

Is it possible to feed Firefox Flash plugin with controlled data for privacy reasons?

For privacy and security reasons, it would be strongly recommended to deactivate the Flash plugin in the browser. But I don't want to deactivate it, I want to fake privacy relevant information. ...
6
votes
1answer
8k views

Can HSTS be disabled in Firefox?

For pentesting/VA, it is, of course, imperative to be always be able to see the HTTP site of a target, if present. HSTS conflicts with this need. Without using a proxy to address the problem (e.g. ...
0
votes
2answers
125 views

Data exposed through campus proxy

I want to connect with Firefox to my university campus proxy, in order to access subscribed research journals, but first I need to know, which of the transmitted data through the network are visible ...
3
votes
0answers
38 views

How to disable typed arrays in firefox as rowhammer mitigation

I am concerned about the potential attack surface exposed by JavaScript typed arrays as a means of performing rowhammer attacks. Is it possible to disable (via official means or otherwise) typed ...