Firefox is a Web browser that is smaller, faster, and in some ways more secure than the Netscape browser from which much of its code was derived.

learn more… | top users | synonyms

1
vote
0answers
41 views

How secure is the native browser password autofill?

Safari, Chrome, Firefox, Edge, and IE all either have a suggest-password feature, or password archival feature. How secure are these passwords when stored on a computer? If replicated, how secure ...
4
votes
1answer
58 views

Does using creating a seprate firefox profile cause a seprate security context protect against XSS and DNS Re-binding?

I read here that I should use separate security profiles for different sorts of things; accessing sensitive information, doing system administration vs. opening links from emails. I know that ...
15
votes
3answers
2k views

How secure is “Firefox Hello”?

The new "Firefox Hello" feature promises easy and safe video conversation. It is not nescessary to create an account, you simply share a link with your partner to start the conversation. The ...
1
vote
4answers
2k views

Are these “Urgent Firefox Update” popups bogus?

I've gotten, over the past couple of weeks, at least three screens popping up saying "Urgent Firefox Update". These are from URL https://eexowdlzyjx.net/. At least once they have been preceded by "...
0
votes
1answer
47 views

Script injection on all browsers

I have something injecting a script into all web browsers that I have tried - Firefox, IE, Edge, Chrome - and it doesn't look like an extension (since it is doing so in different web browsers). I ...
5
votes
2answers
200 views

What Firefox settings should be changed from factory defaults to ensure privacy vis-à-vis Mozilla?

Besides turning off everything in Edit/Preferences/Advanced/Data Choices and browser.newtabpage.directory.ping browser.newtabpage.directory.source browser.safebrowsing... security.ssl.errorReporting....
0
votes
4answers
65 views

Random pop ups caused by add on in Firefox

I'm a bit conflicted. Firefox was open to it's default home page and after a few minutes of inactivity a new tab opens by itself to this (seemingly harmless) webpage: http://barisderin.com/?p=2264 ...
15
votes
1answer
184 views

Preventing a site from appearing in the 'Most Visited' or 'speed dial' section of a web browser

Are there any established ways of preventing a website from appearing as an icon on the 'Most Visited' / 'Speed dial' / start page of a web browser? One example of this is the tab that opens by ...
0
votes
1answer
42 views

Firefox refuses to use X509 certificate, complaining “Cound not verify this certificate for unknown reasons”

I stumbled upon this question and answer. I have the same problem as the OP, and am sorry to report that the proposed answer does not resolve it. Certificate in question has been verified by OpenSSL-1....
64
votes
13answers
9k views

Should I allow browsers to remember my passwords and synchronize them?

I wonder, how wise is it to allow Chrome and Firefox to a) remember the passwords b) synchronize them? My gut tells me that if it's not man in the middle who can intercept them, but Google and Mozilla ...
1
vote
1answer
744 views

Trying to verify my X509 certificate “could not verify this certificate for unknown reasons”

I have created my own X509 certificate with my own CA. I am able to import the CA certificate into Firefox, but when I try to import the user's certificates I get the following: Could not verify ...
4
votes
1answer
47 views

Does Firefox use OCSP?

And if it does use Online Certificate Status Protocol, is there a way to disable it, so that it uses CRL instead?
7
votes
1answer
2k views

How to make Firefox ignore the X-XSS-Protection response header?

I have two questions: How can I make Firefox ignore the X-XSS-Protection header? I have a website which sends an X-XSS-Protection: 1 header and I want my Firefox to ignore that header, because it ...
1
vote
0answers
33 views

How to change system fonts list in Firefox to avoid browser fingerprinting? [closed]

I found solution for most of types of browser fingerprints: IP - ZenMate Firefox VPN Add-on Canvas - CanvasBlocker Add-on Timezone - I use AutoIt to change Windows Timezone List of PlugIns - I just ...
1
vote
2answers
97 views

Can I trust browsers not to snoop into my activities?

Is there anything stopping web browsers from snooping into our activities? I don't mean web history or any of that generic stuff (Chrome already collects them, right?), but is it technically possible ...
2
votes
1answer
88 views

How to force Firefox to remember passwords?

I use 32-character (128-bit) randomly generated passwords. It's a little bit hard to remember them all, so I use encrypted keyring built into firefox. In this way I have different passwords to ...
0
votes
0answers
25 views

How to check Firefox CA health?

If we have a RHEL based desktop at a workplace, how can we check the health of the Certificate Authorities trusted by Firefox? I mean: The list that which CA is allowed in the webbrowser And that ...
1
vote
1answer
131 views

Firefox security certificate issues: FUD or truth?

I was doing a little reading over at gHacks, and came across this comment attributed to Joey Spinosa regarding certificates in Firefox: These certificates are installed automatically by the ...
7
votes
2answers
221 views

Why does Mozilla Firefox encrypt saved passwords?

If you ask Mozilla Firefox to remember the login details for a website, the credentials will be stored in your profile directory in Logins.json. Instead of storing plaintext values, the username and ...
0
votes
2answers
47 views

Using specific firefox profile of Tor instead of Torbrowser

I create a dedicated profile in Firefox for tor (with firefox -no-remote -p) and configure it to use specific network setting with Edit > Preferences, Advanced > Network > Settings And then: manual ...
0
votes
1answer
62 views

Strange symbols in Firefox address bar with https

Why are there dash marks through the https portion of this address? Is this a feature that's supposed to further accentuate that this is unsecured https? I just thought it was a graphical glitch ...
9
votes
1answer
258 views

Is NoScript bad? [closed]

I just came to know about NoScript, but after installing it opened the author's homepage with an advert for 'SpeedUpMyPC' that pointed to a UniBlue website, which I found fishy. Googling turned up ...
3
votes
2answers
3k views

Firefox can import the .p12 format, but that contains a private key? Isn't this a security risk?

Everywhere I go, people tell me the private keys need to be kept away, possibly even locked into a safe. Then how come Firefox and other keystores expect you to give them a private key? Firefox is a ...
5
votes
2answers
5k views

Password management in Firefox, Chrome and Safari

I just read a couple of very interesting discussions on Chrome password security strategy. Chrome’s insane password security strategy Showing stored passwords - Tim Berners-Lee The following is how ...
4
votes
1answer
142 views

Can canvas fingerprinting be prevented?

How can canvas fingerprinting be prevented in web browsers? The site Panopticlick said I had a hash of WebGL fingerprint of 5 bits of entropy. I installed CanvasBlocker addon and tested again and it ...
8
votes
5answers
5k views

If I use a good Master Password in Firefox, is security improved when I Remember Passwords instead of re-type? [duplicate]

In the old days I would emphasize that people should not select the remember passwords option because (besides the fact you tend to forget what the browser remembers) a bad guy could could display the ...
1
vote
2answers
167 views

Why won't Firefox accept my certificate?

I've been trying to get stunnel to work with my signed certificate (with a CA that I've trusted in Firefox). The error is: 127.0.0.1:5559 uses an invalid security certificate. The certificate is ...
1
vote
1answer
102 views

Should VPN passwords be stored in plaintext?

I know nothing about setting up a VPN, but it happens that I use a VPN add-on for Firefox, and that the VPN provider stores the user password in plaintext. Last week I installed a VPN add-on for ...
36
votes
4answers
4k views

Avast AV could read Firefox saved passwords

My friend uses Firefox's built-in password manager feature to save passwords for sites. Later, after installing Avast Free Antivirus there was a feature called Passwords on the Avast UI. When accessed ...
4
votes
2answers
90 views

Why would a modern browser allow internal resources to be loaded from an external page

Recently someone announced that several Arris surfboard models lacked any form of authentication to perform functions such as reboot and factory reset a modem with a single http call. Read more on ...
4
votes
1answer
45 views

Can going to a bad website on firefox, or installing a malcious firefox plugin, infect other parts of my home folder on a Linux system?

BTW, I don't mean root, just a plain user. I'm worried because I'm scared that if I do such things I could infect my Chromium folder. I got a huge case of OCD.
0
votes
2answers
1k views

Firefox vs. Chrome extensions: Which are---ceteris paribus---more secure?

As an 'extension' to earlier questions on this topic (for instance here and here), What makes Firefox extensions (appear) more secure than Chrome extensions? Do they just appear to be more secure, ...
7
votes
1answer
1k views

Why does Firefox claim that my connection to Google is insecure?

I keep receiving this message whenever I open any site from Google: My Firefox is up-to-date, and so my Windows 8.1. Since I don't know much about HSTS, I don't know what's going on, and obviously, ...
5
votes
2answers
326 views

How do I check if a script is safe to run?

I've been using NoScript for a couple of years now but I can't seem to figure out which scripts are safe to allow and most of the time I just temporarily allow all the scripts. Is there a way to check ...
2
votes
3answers
4k views

Invalid OCSP signing certificate in OCSP response

I want to open the following page in Firefox, and get an error. https://www.acm.nl/nl/ Secure Connection Failed An error occurred during a connection to www.acm.nl. Invalid OCSP signing ...
3
votes
1answer
172 views

Firefox & Chrome Strong Ciphers

Of the following ciphers for RSA authentication, Firefox and Chrome do not use stronger than ECDHE-RSA-AES128-SHA256. ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(256) Mac=AEAD ...
34
votes
3answers
9k views

Is Ghostery safe to use?

I've heard about Ghostery, a browser extension/plugin that blocks web trackers. But according to this link it sells our data. Are add-ons and plugins open source in Firefox? Is there another ...
1
vote
1answer
62 views

HTTPS Everywhere (Firefox) allows mixed content on pages with images

I use HTTPS Everywhere extension for Firefox, and recently I've started witnessing Mixed Content warnings from time to time, apparently when there are images with http:// prefixes (in particular at SE ...
1
vote
1answer
76 views

Does using Ghostery with Privacy Badger impair PB's heuristic learning?

I am running Ghostery and Privacy Badger for FF. From what I have read at eff.org/privacybadger, PB uses a heuristic algorithm to learn what 3rd-party sites are tracking me. If I am running Ghostery ...
5
votes
1answer
236 views

What kind of information is exposed during a Firefox private browsing session?

I'm working with Firefox 43.0.1 on Windows 7 Pro 64 bit. I just noticed an odd behavior, and I don't think Firefox used to behave this way. I had a GMail tab open in private browsing mode, and then ...
22
votes
7answers
2k views

How trustworthy is Firefox? [closed]

I looked at different password managers, to swap my user-generated, more or less predictable passwords for automatically generated, secure passwords. I stumbled upon KeePass and FeeFox (for Firefox ...
0
votes
1answer
234 views

Is firefox disabling of insecure TLS fallback part of the HSTS spec?

I've been looking into HSTS, and I can see that Firefox has supported it since version 4, but I can also see that you could click through untrusted cert browser warnings until Firefox 37. Is the ...
8
votes
3answers
740 views

Why do Firefox and Chrome “leak” critical security information out of the browser and how can I stop it?

In studying SSL / TLS handshakes and encryption, I found a method that describes how to export the SSL / TLS session keys from Firefox to an user or environmental variable outside the browser, and ...
3
votes
0answers
266 views

Untrusted connection when logging to stack exchange sites

I was able to log into various stack exchange sites with no problem, but as of today 1/5/2016 I'm getting the following error message with firefox 43.0.2: You have asked Firefox to connect ...
0
votes
0answers
36 views

Persona private key storage?

Following the Q&A here, I have a few remaining questions: I am still confused about whether the could be any local access from a malicious browser extension to this shimmed private key or not? ...
4
votes
1answer
1k views

How to read the key3.db file?

The file key3.db contains the key that is used to encrypt the Firefox passwords stored in logins.json file. I don't use master password in Firefox, but according to this article, my passwords are ...
0
votes
0answers
25 views

Is there any extra validation that Firefox perform to certificates serial number

I open a secured site in my computer. for my reasons, I created new certificate every 15 minutes. I noticed that, sometimes, Firefox "doesn't like" my certificate. after little investigation, I ...
22
votes
1answer
1k views

How does Firefox encrypt passwords without selecting Master Password?

I know that the file logins.json contains all my encrypted passwords in Firefox browser. How does Firefox encrypt these passwords if I don't use the 'Master Password' option? Does this mean key3.db ...
5
votes
4answers
271 views

Steps after getting hit with malware or browser exploits on Xubuntu

Well, today I was browsing the internet and I suddenly got redirected to a chinese hosted malware site and firefox started going crazy. I checked the url on virustotal with my phone and it found other ...
6
votes
1answer
7k views

Can HSTS be disabled in Firefox?

For pentesting/VA, it is, of course, imperative to be always be able to see the HTTP site of a target, if present. HSTS conflicts with this need. Without using a proxy to address the problem (e.g. ...