Firefox is a Web browser that is smaller, faster, and in some ways more secure than the Netscape browser from which much of its code was derived.

learn more… | top users | synonyms

0
votes
0answers
10 views

Does using Ghostery with Privacy Badger impair PB's heuristic learning?

I am running Ghostery and Privacy Badger for FF. From what I have read at eff.org/privacybadger, PB uses a heuristic algorithm to learn what 3rd-party sites are tracking me. If I am running Ghostery ...
5
votes
1answer
68 views

What kind of information is exposed during a Firefox private browsing session?

I'm working with Firefox 43.0.1 on Windows 7 Pro 64 bit. I just noticed an odd behavior, and I don't think Firefox used to behave this way. I had a GMail tab open in private browsing mode, and then ...
4
votes
1answer
151 views

How make Firefox ignore X-XSS-Protection header from server?

I have two questions: 1)How can I make Firefox ignore X-XSS-Protection header? I have a website which sends X-XSS-Protection: 1 header and I want my Firefox to ignore that header, because it destroys ...
20
votes
7answers
2k views

How trustworthy is Firefox? [closed]

I looked at different password managers, to swap my user-generated, more or less predictable passwords for automatically generated, secure passwords. I stumbled upon KeePass and FeeFox (for Firefox ...
0
votes
1answer
45 views

Is firefox disabling of insecure TLS fallback part of the HSTS spec?

I've been looking into HSTS, and I can see that Firefox has supported it since version 4, but I can also see that you could click through untrusted cert browser warnings until Firefox 37. Is the ...
-1
votes
0answers
11 views

What is the Site “chrome://FirefoxAccounts (Firefox Accounts credentials)” under “Saved Logins” section in Firefox for ? [migrated]

Created a user account in firefox and saved it , I saw these 2 entires in "Saved Login"? It's a bit creepy because I was trying to switch over to Firefox from Chrome.Why is it prefixed "chrome://" ...
7
votes
3answers
529 views

Why do Firefox and Chrome “leak” critical security information out of the browser and how can I stop it?

In studying SSL / TLS handshakes and encryption, I found a method that describes how to export the SSL / TLS session keys from Firefox to an user or environmental variable outside the browser, and ...
12
votes
3answers
1k views

How secure is “Firefox Hello”?

The new "Firefox Hello" feature promises easy and safe video conversation. It is not nescessary to create an account, you simply share a link with your partner to start the conversation. The ...
3
votes
0answers
243 views

Untrusted connection when logging to stack exchange sites

I was able to log into various stack exchange sites with no problem, but as of today 1/5/2016 I'm getting the following error message with firefox 43.0.2: You have asked Firefox to connect ...
0
votes
0answers
30 views

Persona private key storage?

Following the Q&A here, I have a few remaining questions: I am still confused about whether the could be any local access from a malicious browser extension to this shimmed private key or not? ...
3
votes
1answer
136 views

How to read the key3.db file?

The file key3.db contains the key that is used to encrypt the Firefox passwords stored in logins.json file. I don't use master password in Firefox, but according to this article, my passwords are ...
0
votes
0answers
24 views

Is there any extra validation that Firefox perform to certificates serial number

I open a secured site in my computer. for my reasons, I created new certificate every 15 minutes. I noticed that, sometimes, Firefox "doesn't like" my certificate. after little investigation, I ...
22
votes
1answer
1k views

How does Firefox encrypt passwords without selecting Master Password?

I know that the file logins.json contains all my encrypted passwords in Firefox browser. How does Firefox encrypt these passwords if I don't use the 'Master Password' option? Does this mean key3.db ...
5
votes
4answers
252 views

Steps after getting hit with malware or browser exploits on Xubuntu

Well, today I was browsing the internet and I suddenly got redirected to a chinese hosted malware site and firefox started going crazy. I checked the url on virustotal with my phone and it found other ...
4
votes
1answer
2k views

Can HSTS be disabled in Firefox?

For pentesting/VA, it is, of course, imperative to be always be able to see the HTTP site of a target, if present. HSTS conflicts with this need. Without using a proxy to address the problem (e.g. ...
0
votes
2answers
54 views

Analyzing whether browser certificates have been compromised

How can I know that my installed certificates (in Firefox), are (still) reliable?
1
vote
1answer
80 views

How to determine which Browser Certs to reenable on a per-case basis?

Considering that there is no way to actually see which certs that I use in my regularly-visited websites, I've decided to disable all certs and re-enable them on a case by case basis. This is for the ...
4
votes
1answer
41 views

Does using creating a seprate firefox profile cause a seprate security context to protect against XSS and DNS Re-binding?

I read here that I should use separate security profiles for different sorts of things; accessing sensitive information, doing system administration vs. opening links from emails. I know that ...
6
votes
1answer
206 views

Is mega.co.nz using my Browser for cracking passwords?

recently i found on my Firefox Profil, under .../storage/.../idb/ a File named "https+++mega.co.nz", i looked inside those files, some are encrypted (couldnt read it in Notepad++), but i found 27 ...
-1
votes
1answer
129 views

Why is deleting the navigation history of Firefox is not reflected in file 'places.sqlite'? [closed]

This file is where Firefox saves bookmarks and navigation history. I cleared the history navigation from the GUI of Firefox. I went back to places.sqlite, and I found everything is still there. Why ...
3
votes
2answers
98 views

How is HSTS handled on subdomains?

I recently audited a website with three hosts: the main site (example.com), and two subdomains (let's call them portal.example.com, and welcome.example.com). According to the response headers, HSTS ...
0
votes
0answers
20 views

Sites to test login through jmeter [duplicate]

Im having a hard time looking for a site with a login system that can be probed with firebug, the POST request password specifically, i was just wondering if anyone here knows one or two sites that ...
27
votes
3answers
5k views

Firebug appears to be decrypting SSL traffic: is it the correct behaviour?

In my company we were writing a small web application which would be hosted and tested under HSTS protocol. One of my tester complained that the username and password can be seen in cleartext so it ...
2
votes
1answer
90 views

Chrome/FF not negotiating advanced ciphers?

Ran into a weird problem trying to lock down our AWS ELBs today, specifically trying to deprecate all support for SHA-1. Having removed options like AES256-SHA ECDHE-RSA-AES256-SHA (among others) ...
13
votes
2answers
26k views

How do some sites detect AdBlock Plus? [closed]

For example this one disables function if AdBlock plus is detected, and it works. Is there a way to circumvent this?
1
vote
1answer
103 views

Is it possible to feed Firefox Flash plugin with controlled data for privacy reasons?

For privacy and security reasons, it would be strongly recommended to deactivate the Flash plugin in the browser. But I don't want to deactivate it, I want to fake privacy relevant information. ...
3
votes
3answers
244 views

Is Firefox on Ubuntu less secured (does it not confine Flash)?

Ubuntu Linux makes it easy to install Flash as soon as you encounter it. Just like Firefox on Windows really! Using Ubuntu's package it even provides security updates through the standard OS ...
4
votes
2answers
312 views

Security of Firefox extensions such as Mailvelope

I am asking these question because I am not very familiar with JavaScript or the Firefox plugin/extension system. The specific context is the Mailvelope pgp extension but the questions are general and ...
21
votes
3answers
1k views

Are official browser add-ons really safe?

Almost any browser addon/extension that I install on my Chrome or Firefox (be it Firebug, RESTClient, ...) warns me, saying: It [the add-on] can: Access your data on all website Access ...
0
votes
2answers
123 views

Data exposed through campus proxy

I want to connect with Firefox to my university campus proxy, in order to access subscribed research journals, but first I need to know, which of the transmitted data through the network are visible ...
2
votes
0answers
24 views

How to disable typed arrays in firefox as rowhammer mitigation

I am concerned about the potential attack surface exposed by JavaScript typed arrays as a means of performing rowhammer attacks. Is it possible to disable (via official means or otherwise) typed ...
31
votes
3answers
7k views

Is Ghostery safe to use?

I've heard about Ghostery, a browser extension/plugin that blocks web trackers. But according to this link it sells our data. Are add-ons and plugins open source in Firefox? Is there another ...
2
votes
2answers
723 views

How safe are Firefox addons from official mozilla.org site?

I would like to install the Dictionary Pop-Up addon for Firefox. I usually don't install any addons, but this one looks especially tempting. I could not find any information on the Mozilla page, ...
0
votes
0answers
18 views

What is the goal of sign a key in BrowserID certificate?

I'm learning about the Mozilla Auth. it has an implementation of SRP protocol in https://github.com/mozilla/fxa-auth-server/blob/master/docs/overview.md and his client; example is ...
2
votes
1answer
181 views

Could the causes of CVE-2015-2502 vulnerability be common to Firefox and Chrome?

On Tuesday August 18, 2015, Microsoft published an advisory pointing out a 0-day vulnerability (CVE-2015-2502) that can be exploited by an attacker to perform a remote code execution on Internet ...
3
votes
2answers
71 views

Is a server which FTP credentials were kept in a machine with Firefox being used compromised after the latest firefox vulnerability?

Since the vulnerability was specifically targeting FTP passwords in Windows machines there were used with things like Filezilla, can a server which SFTP credentials were kept in a windows machine ...
10
votes
1answer
179 views

Firefox trying to connect to other computers on the LAN

While running Wireshark trying to troubleshoot some other issues, I noticed several SYN connections to ports 80 and 443 on the workstation I was using. The packets were dropped. These were coming from ...
7
votes
1answer
138 views

Protection against clickjacking in Firefox without installing addons?

On some of my workstations I never allow Javascript in Firefox. The NoScript addon is installed on these machines, but I would like to remove it and disable Javascript via about:config instead. ...
8
votes
1answer
33k views

Firefox:Secure connection failed(Error code:ssl_error_weak_server_ephemeral_dh_key)

A screenshot of the problem: Browser: Firefox 39.0 Is this a problem with my browser? How can I solve this?
2
votes
1answer
148 views

What Firefox settings should be changed from factory defaults to ensure privacy vis-à-vis Mozilla?

Besides turning off everything in Edit/Preferences/Advanced/Data Choices and browser.newtabpage.directory.ping browser.newtabpage.directory.source browser.safebrowsing... ...
2
votes
0answers
115 views

Should Mozilla SSL3/RC4 whitelisted sites be blacklisted by admins/users? [closed]

As of Firefox 39, Mozilla has dropped support for SSL3 and RC4... and whitelisted 519 (!) non-compliant sites: ...
2
votes
2answers
96 views

Is it any more or less secure to delete all my cookies vs. individually logging out?

So I've lost all of my Firefox bookmarks (well not since 3.0) or history (3.5?) or my current session enough times (yeah... this still happens) that I don't leave my precious Firefox profile to ...
0
votes
1answer
114 views

Source code of Firefox Add-ons

How can I be sure that a browser add-on that is released under the GPL is actually really using the source code that was published? I read somewhere that the source code of Chrome add-ons is viewable ...
0
votes
1answer
289 views

What is safebrowsing.google.com ?Does it impact the security testing?

I recently security tested my web application using Firefox browser and while pentesting my webapplication i noticed safebrowsing.google.com,while i diged more about it ,i could able to retreive only ...
2
votes
2answers
92 views

ssl_error_bad_certificate_domain, does Firefox still validate the certificate? [duplicate]

I have a private NAS device. It uses a self-signed SSL certificate. I can import the cert into Firefox and everything works as long as I'm accessing the device from somewhere on the internet. SSL ...
1
vote
1answer
59 views

FireFTP security [closed]

I've just installed the FireFTP plugin for Firefox, I have been using Adobe Dreamweaver's FTP up to now but wanted to try something different. When I opened it up and saw all of my computer's files ...
5
votes
2answers
2k views

How Do I Troubleshoot a Browser Hijack on a Mac?

My Mac is getting weird redirects with Safari and Chrome, however not with Mozilla Firefox. Since I cannot find software to do malware removal on Apple products or any good information, I am at a loss ...
1
vote
1answer
587 views

Does the browser still stores the website you visited Private Browsing [incognito Firefox]?

As they clearly state in their website they mention that What does Private Browsing not save? Visited pages: No pages will be added to the list of sites in the History menu, the Library window's ...
10
votes
3answers
375 views

Do I have to harden IE if I'm only using Firefox?

Assume a Windows 7 system (probably whatever home version comes with the machine), with the latest OS patches, latest IE and latest Firefox. Also assume that the user uses only Firefox for browsing, ...
1
vote
2answers
104 views

Browser Updated, yet still vulnerable to POODLE

So here's a situation, some of my company's partners notified us that they will be entirely disable their server's SSLv3 support. This prompts my superior to take this chance to update our operation ...