Firefox is a Web browser that is smaller, faster, and in some ways more secure than the Netscape browser from which much of its code was derived.

learn more… | top users | synonyms

7
votes
4answers
5k views

If I use a good Master Password in Firefox, is security improved when I Remember Passwords instead of re-type?

In the old days I would emphasize that people should not select the remember passwords option because (besides the fact you tend to forget what the browser remembers) a bad guy could could display the ...
1
vote
2answers
115 views

Why won't Firefox accept my certificate?

I've been trying to get stunnel to work with my signed certificate (with a CA that I've trusted in Firefox). The error is: 127.0.0.1:5559 uses an invalid security certificate. The certificate is ...
1
vote
1answer
80 views

Should VPN passwords be stored in plaintext?

I know nothing about setting up a VPN, but it happens that I use a VPN add-on for Firefox, and that the VPN provider stores the user password in plaintext. Last week I installed a VPN add-on for ...
36
votes
4answers
4k views

Avast AV could read Firefox saved passwords

My friend uses Firefox's built-in password manager feature to save passwords for sites. Later, after installing Avast Free Antivirus there was a feature called Passwords on the Avast UI. When accessed ...
4
votes
2answers
79 views

Why would a modern browser allow internal resources to be loaded from an external page

Recently someone announced that several Arris surfboard models lacked any form of authentication to perform functions such as reboot and factory reset a modem with a single http call. Read more on ...
3
votes
1answer
32 views

Can going to a bad website on firefox, or installing a malcious firefox plugin, infect other parts of my home folder on a Linux system?

BTW, I don't mean root, just a plain user. I'm worried because I'm scared that if I do such things I could infect my Chromium folder. I got a huge case of OCD.
0
votes
2answers
1k views

Firefox vs. Chrome extensions: Which are---ceteris paribus---more secure?

As an 'extension' to earlier questions on this topic (for instance here and here), What makes Firefox extensions (appear) more secure than Chrome extensions? Do they just appear to be more secure, ...
7
votes
1answer
234 views

Why does Firefox claim that my connection to Google is insecure?

I keep receiving this message whenever I open any site from Google: My Firefox is up-to-date, and so my Windows 8.1. Since I don't know much about HSTS, I don't know what's going on, and obviously, ...
5
votes
1answer
679 views

How make Firefox ignore X-XSS-Protection header from server?

I have two questions: 1)How can I make Firefox ignore X-XSS-Protection header? I have a website which sends X-XSS-Protection: 1 header and I want my Firefox to ignore that header, because it destroys ...
5
votes
2answers
301 views

How do I check if a script is safe to run?

I've been using NoScript for a couple of years now but I can't seem to figure out which scripts are safe to allow and most of the time I just temporarily allow all the scripts. Is there a way to check ...
64
votes
13answers
9k views

Should I allow browsers to remember my passwords and synchronize them?

I wonder, how wise is it to allow Chrome and Firefox to a) remember the passwords b) synchronize them? My gut tells me that if it's not man in the middle who can intercept them, but Google and Mozilla ...
2
votes
3answers
4k views

Invalid OCSP signing certificate in OCSP response

I want to open the following page in Firefox, and get an error. https://www.acm.nl/nl/ Secure Connection Failed An error occurred during a connection to www.acm.nl. Invalid OCSP signing ...
3
votes
1answer
87 views

Firefox & Chrome Strong Ciphers

Of the following ciphers for RSA authentication, Firefox and Chrome do not use stronger than ECDHE-RSA-AES128-SHA256. ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(256) Mac=AEAD ...
34
votes
3answers
8k views

Is Ghostery safe to use?

I've heard about Ghostery, a browser extension/plugin that blocks web trackers. But according to this link it sells our data. Are add-ons and plugins open source in Firefox? Is there another ...
1
vote
1answer
52 views

HTTPS Everywhere (Firefox) allows mixed content on pages with images

I use HTTPS Everywhere extension for Firefox, and recently I've started witnessing Mixed Content warnings from time to time, apparently when there are images with http:// prefixes (in particular at SE ...
1
vote
1answer
43 views

Does using Ghostery with Privacy Badger impair PB's heuristic learning?

I am running Ghostery and Privacy Badger for FF. From what I have read at eff.org/privacybadger, PB uses a heuristic algorithm to learn what 3rd-party sites are tracking me. If I am running Ghostery ...
5
votes
1answer
135 views

What kind of information is exposed during a Firefox private browsing session?

I'm working with Firefox 43.0.1 on Windows 7 Pro 64 bit. I just noticed an odd behavior, and I don't think Firefox used to behave this way. I had a GMail tab open in private browsing mode, and then ...
22
votes
7answers
2k views

How trustworthy is Firefox? [closed]

I looked at different password managers, to swap my user-generated, more or less predictable passwords for automatically generated, secure passwords. I stumbled upon KeePass and FeeFox (for Firefox ...
0
votes
1answer
79 views

Is firefox disabling of insecure TLS fallback part of the HSTS spec?

I've been looking into HSTS, and I can see that Firefox has supported it since version 4, but I can also see that you could click through untrusted cert browser warnings until Firefox 37. Is the ...
8
votes
3answers
636 views

Why do Firefox and Chrome “leak” critical security information out of the browser and how can I stop it?

In studying SSL / TLS handshakes and encryption, I found a method that describes how to export the SSL / TLS session keys from Firefox to an user or environmental variable outside the browser, and ...
14
votes
3answers
1k views

How secure is “Firefox Hello”?

The new "Firefox Hello" feature promises easy and safe video conversation. It is not nescessary to create an account, you simply share a link with your partner to start the conversation. The ...
3
votes
0answers
262 views

Untrusted connection when logging to stack exchange sites

I was able to log into various stack exchange sites with no problem, but as of today 1/5/2016 I'm getting the following error message with firefox 43.0.2: You have asked Firefox to connect ...
0
votes
0answers
36 views

Persona private key storage?

Following the Q&A here, I have a few remaining questions: I am still confused about whether the could be any local access from a malicious browser extension to this shimmed private key or not? ...
3
votes
1answer
429 views

How to read the key3.db file?

The file key3.db contains the key that is used to encrypt the Firefox passwords stored in logins.json file. I don't use master password in Firefox, but according to this article, my passwords are ...
0
votes
0answers
25 views

Is there any extra validation that Firefox perform to certificates serial number

I open a secured site in my computer. for my reasons, I created new certificate every 15 minutes. I noticed that, sometimes, Firefox "doesn't like" my certificate. after little investigation, I ...
22
votes
1answer
1k views

How does Firefox encrypt passwords without selecting Master Password?

I know that the file logins.json contains all my encrypted passwords in Firefox browser. How does Firefox encrypt these passwords if I don't use the 'Master Password' option? Does this mean key3.db ...
5
votes
4answers
257 views

Steps after getting hit with malware or browser exploits on Xubuntu

Well, today I was browsing the internet and I suddenly got redirected to a chinese hosted malware site and firefox started going crazy. I checked the url on virustotal with my phone and it found other ...
5
votes
1answer
5k views

Can HSTS be disabled in Firefox?

For pentesting/VA, it is, of course, imperative to be always be able to see the HTTP site of a target, if present. HSTS conflicts with this need. Without using a proxy to address the problem (e.g. ...
0
votes
2answers
59 views

Analyzing whether browser certificates have been compromised

How can I know that my installed certificates (in Firefox), are (still) reliable?
1
vote
1answer
89 views

How to determine which Browser Certs to reenable on a per-case basis?

Considering that there is no way to actually see which certs that I use in my regularly-visited websites, I've decided to disable all certs and re-enable them on a case by case basis. This is for the ...
4
votes
1answer
43 views

Does using creating a seprate firefox profile cause a seprate security context to protect against XSS and DNS Re-binding?

I read here that I should use separate security profiles for different sorts of things; accessing sensitive information, doing system administration vs. opening links from emails. I know that ...
6
votes
1answer
342 views

Is mega.co.nz using my Browser for cracking passwords?

recently i found on my Firefox Profil, under .../storage/.../idb/ a File named "https+++mega.co.nz", i looked inside those files, some are encrypted (couldnt read it in Notepad++), but i found 27 ...
3
votes
2answers
122 views

How is HSTS handled on subdomains?

I recently audited a website with three hosts: the main site (example.com), and two subdomains (let's call them portal.example.com, and welcome.example.com). According to the response headers, HSTS ...
0
votes
0answers
20 views

Sites to test login through jmeter [duplicate]

Im having a hard time looking for a site with a login system that can be probed with firebug, the POST request password specifically, i was just wondering if anyone here knows one or two sites that ...
27
votes
3answers
6k views

Firebug appears to be decrypting SSL traffic: is it the correct behaviour?

In my company we were writing a small web application which would be hosted and tested under HSTS protocol. One of my tester complained that the username and password can be seen in cleartext so it ...
2
votes
1answer
104 views

Chrome/FF not negotiating advanced ciphers?

Ran into a weird problem trying to lock down our AWS ELBs today, specifically trying to deprecate all support for SHA-1. Having removed options like AES256-SHA ECDHE-RSA-AES256-SHA (among others) ...
14
votes
2answers
30k views

How do some sites detect AdBlock Plus? [closed]

For example this one disables function if AdBlock plus is detected, and it works. Is there a way to circumvent this?
2
votes
1answer
151 views

Is it possible to feed Firefox Flash plugin with controlled data for privacy reasons?

For privacy and security reasons, it would be strongly recommended to deactivate the Flash plugin in the browser. But I don't want to deactivate it, I want to fake privacy relevant information. ...
2
votes
3answers
260 views

Is Firefox on Ubuntu less secured (does it not confine Flash)?

Ubuntu Linux makes it easy to install Flash as soon as you encounter it. Just like Firefox on Windows really! Using Ubuntu's package it even provides security updates through the standard OS ...
4
votes
2answers
353 views

Security of Firefox extensions such as Mailvelope

I am asking these question because I am not very familiar with JavaScript or the Firefox plugin/extension system. The specific context is the Mailvelope pgp extension but the questions are general and ...
21
votes
3answers
1k views

Are official browser add-ons really safe?

Almost any browser addon/extension that I install on my Chrome or Firefox (be it Firebug, RESTClient, ...) warns me, saying: It [the add-on] can: Access your data on all website Access ...
0
votes
2answers
125 views

Data exposed through campus proxy

I want to connect with Firefox to my university campus proxy, in order to access subscribed research journals, but first I need to know, which of the transmitted data through the network are visible ...
2
votes
0answers
32 views

How to disable typed arrays in firefox as rowhammer mitigation

I am concerned about the potential attack surface exposed by JavaScript typed arrays as a means of performing rowhammer attacks. Is it possible to disable (via official means or otherwise) typed ...
2
votes
2answers
822 views

How safe are Firefox addons from official mozilla.org site?

I would like to install the Dictionary Pop-Up addon for Firefox. I usually don't install any addons, but this one looks especially tempting. I could not find any information on the Mozilla page, ...
0
votes
0answers
20 views

What is the goal of sign a key in BrowserID certificate?

I'm learning about the Mozilla Auth. it has an implementation of SRP protocol in https://github.com/mozilla/fxa-auth-server/blob/master/docs/overview.md and his client; example is ...
3
votes
1answer
207 views

Could the causes of CVE-2015-2502 vulnerability be common to Firefox and Chrome?

On Tuesday August 18, 2015, Microsoft published an advisory pointing out a 0-day vulnerability (CVE-2015-2502) that can be exploited by an attacker to perform a remote code execution on Internet ...
2
votes
2answers
75 views

Is a server which FTP credentials were kept in a machine with Firefox being used compromised after the latest firefox vulnerability?

Since the vulnerability was specifically targeting FTP passwords in Windows machines there were used with things like Filezilla, can a server which SFTP credentials were kept in a windows machine ...
10
votes
1answer
208 views

Firefox trying to connect to other computers on the LAN

While running Wireshark trying to troubleshoot some other issues, I noticed several SYN connections to ports 80 and 443 on the workstation I was using. The packets were dropped. These were coming from ...
7
votes
1answer
181 views

Protection against clickjacking in Firefox without installing addons?

On some of my workstations I never allow Javascript in Firefox. The NoScript addon is installed on these machines, but I would like to remove it and disable Javascript via about:config instead. ...
8
votes
1answer
36k views

Firefox:Secure connection failed(Error code:ssl_error_weak_server_ephemeral_dh_key)

A screenshot of the problem: Browser: Firefox 39.0 Is this a problem with my browser? How can I solve this?