Hot answers tagged

61

To expand on what @d1str0 said: if the creator of your browser wanted to steal your passwords, it would be trivial to send them to a manufacturer controlled server whenever you entered them - they don't need to bother with the hassle of telling you about sync procedures, or offering to remember passwords. All browsers by default send a certain level of usage ...


54

Sounds like there is some confusion over the protections that different parts of your system provide. HSTS enforces HTTPS for users who have previously visited the site over HTTPS, for a given period. If a user has never visited the HTTPS version of a site, and the site is also available over HTTP (without a redirect to HTTPS), it will do nothing - the ...


49

Passwords saved by Firefox are not encrypted (they are encrypted but the key can be read out) until you set a master password. I don't think that this is a bug, but every virus could read those passwords nonetheless


44

If you were worried about Chrome or Firefox stealing your passwords, you wouldn't be using them as a web browser in the first place. An application like Keepass or LastPass can keep your passwords encrypted with a master password. If you don't use a master password, your web browser can unencrypt your passwords at any time. It's up to you on what level ...


36

You can prevent Ghostery from selling your data by opting out of the Ghost Rank feature. The feature is opt-in, so if you didn't already opt in there is nothing you need to do. It is then safe for you to use. Using a clone of Ghostery which is identical in every aspect except not having the Ghost Rank feature would make no practical difference from running ...


30

Another plugin worth mentioning is Privacy Badger. It's fairly new, but from the EFF, to which I would trust not to do any bad stuff. It's also fairly intelligent since it's not using Blacklist which is always a race against tracker vendors, but uses an algorithm to determine what it should block. I'm using it and am pretty happy with it. The only downside ...


27

You cannot assume that an add-on is safe "because it's hosted in one of the official extension galleries". In this answer, I start with the explanation of how extensions end up in the extension galleries for the popular browsers. At the end, I dedicate an extra section to Chrome. How does an item get listed in the official stores? Anyone with Google ...


25

When the profile is initialized, a blank password (an empty string) is used. You can find the code for this in toolkit/components/passwordmgr/crypto-SDR.js on line 64: if (token.needsUserInit) { this.log("Initializing key3.db with default blank password."); token.initPassword(""); } Additionally, based on the import method in ...


23

I actually think the Mozilla devs have been pretty smart with this. Historically, most PDF exploits have come from the rendering engine rather than the parsing side. Adobe got wise early to the fact that malformed structure and content would screw them, and put a lot of effort into making sure that their parsing engine was rock solid. If you look at some of ...


22

There are many scripts and projects to help site owners detect AdBlock Plus, but I think you're interested in how they work. The idea is simple. The website loads a JavaScript file called ads.js (or any other name that AdBlock Plus finds "attractive"), which contains: var amIHere = document.createElement("div"); amIHere.setAttribute("id", "amIHere"); ...


21

No Firebug doesn't decrypt SSL traffic. Firebug just remind of one key detail: a SSL connection provides a protection against eavesdropping on the connection path. SSL should be seen as a crypted tunnel (VPN is another one), but on both ends of the tunnel, everything is in full light: in clear. Firebug isn't a vulnerability at all.


19

Technically, the popup does not ask you whether you really want to download the file; that decision, you already took when you clicked on the link which triggered the download. The popup asks you what Firefox should do with the file when it has been fully downloaded. Potentially hostile files can be a security issue. Filesystems normally store files as ...


19

I agree with RobM. So it would be possible that they share everything they know about me with (american) governmental organizations. Yes, very possible. Are there even alternative browsers which wouldn't do this? The Onion Router. There may be others. Even Firefox will work this way if you use local syncing, and disable malware and phishing ...


19

Firefox can decrypt the passwords without you entering a password. That means it must have the decryption key--which means any program that knows how Firefox stores things can find them. This applies to any program that stores information on your system. Encryption is only a strong defense if you have to provide the decryption key before accessing the ...


12

I'm guessing that uninstalling IE is impossible or impractical. Go to Control Panel -> Uninstall a program -> Turn Windows features on or off. There you can deselect Internet Explorer. You need to harden IE as well. An application could launch or embed an IE window that could then be used to gain control of the system. Consider this attack: an attacker ...


12

Exploits fall into roughly two distinct categories: those which break the semantic rules of the implementation language (buffer overflows, use-after-free, uncontrolled type casts...) and those which play "by the rules". Since the new PDF reader is written in Javascript, exploits from the first category ought to be extremely rare, because of the intrinsic ...


12

IMPORTANT: This is in noway a full list of the things you should look for, use this answer as an example, a first step in your path and research on your own. I've had a similar task long time ago. I had to security-wise review the code of a Firefox addon, I'm sure you'll easily find Chrome/other browsers' equivalents. Also have in mind the Extensions in ...


12

Is this a problem with my browser? Firefox 39 and the Firefox 31 and 38 ESR releases upgrade the TLS implementation NSS to version 3.19.1. To harden the browser against Logjam attack the minimum key length for DH parameter within the TLS handshake is now 1023 bits. But the server at acs.onlinesbi.com only uses a DH key of 768 bit. This key length is ...


11

Looks like the certificate is only valid for opensource.apple.com, not www.opensource.apple.com: www.opensource.apple.com uses an invalid security certificate. The certificate is only valid for opensource.apple.com (Error code: ssl_error_bad_cert_domain) You can simply use the former.


10

In Firefox: Yes, absolutely. Nothing about the Firefox architecture prevents them from doing so. While the passwords are in theory "encrypted" while stored on disk, the decryption key is also stored on disk. Therefore, any software with access to the filesystem will find it trivial to decrypt the stored passwords and access them. (If you don't want to ...


10

Firefox does not support MHT files without addons. It is possible that you have tricked Firefox into opening each MIME object from the MHT file into a new tab. It is doubtful that this could turn into a security flaw. Update: I confirm that behavior with a valid MHT file. It is a Firefox configuration issue. By default, Firefox will not recognize the ...


10

How does Firefox save the passwords? Previous answers have already presented the general idea, but a more in-depth explanation can be provided. Firefox stores all user information in the profile folder. On Windows, it's located under %APPDATA%\Mozilla\Firefox\Profiles\; and on Linux, ~/.mozilla/firefox/. The profile folder is created the first time ...


9

When compromised you should re-install your machine completely. There is no way of knowing for sure that nothing else has been compromised.


9

In addition to the answers regarding password managers, there is a moment where you must allow for uncertainty. To take the example of KeePass: in addition to trusting people who review the code (or trusting yourself to have the knowledge to review it yourself), you also need to trust the provider of the binary (that it matches with the advertised code). Or ...


8

Read this document. Relevant excerpt (page 3): The Firefox platform has no mechanisms to restrict the privileges of add-ons. The add-on code is fully trusted by Firefox. The installation of malicious add-ons can result in full system compromise. There is no security measure to restrict the intercommunication between add-ons. As a result an add-on ...


8

WebRTC is a P2P technology and performs encryption end-to-end by default. No metadata on Mozilla's servers. Per session encryption, so Mozilla cannot decrypt. There may be some vulnerabilities with the technology (i.e. there are), but the design is supposed to address your questions on an architectural level.


7

When I tried downloading from https://www.mozilla.org/en-US/firefox/fx/ I was pointed to http://mirrors.coreix.net once, then http://mozilla.mirror.nexicom.net/, then http://mozilla.c3sl.ufpr.br. Whether this is the way Firefox's download page is supposed to work or not, I do not know myself. A more appropriate way to resolve this though, would be to ask: ...


7

Yes it's possible, even over ssh and quite trivial to do. Enable X11 forwarding over ssh (e.g., -X option), start firefox, go to Preferences -> Security -> Saved Passwords -> Show Saved Passwords. You could also find them in the relevant files in ~/.mozilla/firefox/{ user_profile } specifically key3.db for the encryption key and signons.sqlite for the ...


7

This is the "1/n-1 split" technique which has been deployed in SSL libraries as a workaround for the BEAST attack. The BEAST attack is the application to a Web context of a chosen plaintext attack. The attack works when: The encryption uses a block cipher in CBC mode. The attacker can choose the data that gets encrypted (in a Web context, this is done ...


7

Typically developer versions (called beta editions in the Software Lifecyle) are used to showcase upcoming features. Some of these features haven't gone through the rigorous testing as a stable (Release) version. To illustrate this, here is Chrome's explanation documenting the differences Stable channel: This channel has the full testing of the Chrome OS ...



Only top voted, non community-wiki answers of a minimum length are eligible