Tag Info

Hot answers tagged

28

You can prevent Ghostery from selling your data by opting out of the Ghost Rank feature. The feature is opt-in, so if you didn't already opt in there is nothing you need to do. It is then safe for you to use. Using a clone of Ghostery which is identical in every aspect except not having the Ghost Rank feature would make no practical difference from running ...


24

You cannot assume that an add-on is safe "because it's hosted in one of the official extension galleries". In this answer, I start with the explanation of how extensions end up in the extension galleries for the popular browsers. At the end, I dedicate an extra section to Chrome. How does an item get listed in the official stores? Anyone with Google ...


24

Another plugin worth mentioning is Privacy Badger. It's fairly new, but from the EFF, to which I would trust not to do any bad stuff. It's also fairly intelligent since it's not using Blacklist which is always a race against tracker vendors, but uses an algorithm to determine what it should block. I'm using it and am pretty happy with it. The only downside ...


23

I actually think the Mozilla devs have been pretty smart with this. Historically, most PDF exploits have come from the rendering engine rather than the parsing side. Adobe got wise early to the fact that malformed structure and content would screw them, and put a lot of effort into making sure that their parsing engine was rock solid. If you look at some of ...


17

Technically, the popup does not ask you whether you really want to download the file; that decision, you already took when you clicked on the link which triggered the download. The popup asks you what Firefox should do with the file when it has been fully downloaded. Potentially hostile files can be a security issue. Filesystems normally store files as ...


14

There are many scripts and projects to help site owners detect AdBlock Plus, but I think you're interested in how they work. The idea is simple. The website loads a JavaScript file called ads.js (or any other name that AdBlock Plus finds "attractive"), which contains: var amIHere = document.createElement("div"); amIHere.setAttribute("id", "amIHere"); If ...


12

I'm guessing that uninstalling IE is impossible or impractical. Go to Control Panel -> Uninstall a program -> Turn Windows features on or off. There you can deselect Internet Explorer. You need to harden IE as well. An application could launch or embed an IE window that could then be used to gain control of the system. Consider this attack: an attacker ...


12

Exploits fall into roughly two distinct categories: those which break the semantic rules of the implementation language (buffer overflows, use-after-free, uncontrolled type casts...) and those which play "by the rules". Since the new PDF reader is written in Javascript, exploits from the first category ought to be extremely rare, because of the intrinsic ...


11

IMPORTANT: This is in noway a full list of the things you should look for, use this answer as an example, a first step in your path and research on your own. I've had a similar task long time ago. I had to security-wise review the code of a Firefox addon, I'm sure you'll easily find Chrome/other browsers' equivalents. Also have in mind the Extensions in ...


11

Looks like the certificate is only valid for opensource.apple.com, not www.opensource.apple.com: www.opensource.apple.com uses an invalid security certificate. The certificate is only valid for opensource.apple.com (Error code: ssl_error_bad_cert_domain) You can simply use the former.


11

Is this a problem with my browser? Firefox 39 and the Firefox 31 and 38 ESR releases upgrade the TLS implementation NSS to version 3.19.1. To harden the browser against Logjam attack the minimum key length for DH parameter within the TLS handshake is now 1023 bits. But the server at acs.onlinesbi.com only uses a DH key of 768 bit. This key length is ...


10

Firefox does not support MHT files without addons. It is possible that you have tricked Firefox into opening each MIME object from the MHT file into a new tab. It is doubtful that this could turn into a security flaw. Update: I confirm that behavior with a valid MHT file. It is a Firefox configuration issue. By default, Firefox will not recognize the ...


9

When compromised you should re-install your machine completely. There is no way of knowing for sure that nothing else has been compromised.


8

In Firefox: Yes, absolutely. Nothing about the Firefox architecture prevents them from doing so. While the passwords are in theory "encrypted" while stored on disk, the decryption key is also stored on disk. Therefore, any software with access to the filesystem will find it trivial to decrypt the stored passwords and access them. (If you don't want to ...


8

Read this document. Relevant excerpt (page 3): The Firefox platform has no mechanisms to restrict the privileges of add-ons. The add-on code is fully trusted by Firefox. The installation of malicious add-ons can result in full system compromise. There is no security measure to restrict the intercommunication between add-ons. As a result an add-on ...


8

WebRTC is a P2P technology and performs encryption end-to-end by default. No metadata on Mozilla's servers. Per session encryption, so Mozilla cannot decrypt. There may be some vulnerabilities with the technology (i.e. there are), but the design is supposed to address your questions on an architectural level.


7

When I tried downloading from https://www.mozilla.org/en-US/firefox/fx/ I was pointed to http://mirrors.coreix.net once, then http://mozilla.mirror.nexicom.net/, then http://mozilla.c3sl.ufpr.br. Whether this is the way Firefox's download page is supposed to work or not, I do not know myself. A more appropriate way to resolve this though, would be to ask: ...


7

Yes it's possible, even over ssh and quite trivial to do. Enable X11 forwarding over ssh (e.g., -X option), start firefox, go to Preferences -> Security -> Saved Passwords -> Show Saved Passwords. You could also find them in the relevant files in ~/.mozilla/firefox/{ user_profile } specifically key3.db for the encryption key and signons.sqlite for the ...


7

Typically developer versions (called beta editions in the Software Lifecyle) are used to showcase upcoming features. Some of these features haven't gone through the rigorous testing as a stable (Release) version. To illustrate this, here is Chrome's explanation documenting the differences Stable channel: This channel has the full testing of the Chrome OS ...


6

There are two issues here which make me say no you can't trust them 100%. Now the reason being is that you haven't reviewed the code on one side. It might contain some malicious code which was slipped in by a rogue developer or intentionally by the organization. For standard organisations this is normally very uncommon, but there have been cases such as ...


6

Safe Browsing API Google offers Safe Browsing, which uses URL lists as well as heuristics: Safe Browsing works in two ways to help protect you against phishing and malware. First, Google downloads a list of information to your browser about sites that may contain malicious software or engage in phishing. If the URL of the site you're on matches ...


6

To disable it just write about:config in the address bar and search for network.prefetch-next. Set this to false and no pre-downloading should occur. - This does not work on 18.0.2 on Ubuntu or Windows 7, although it is the only method I have found searching the web. I have tried various other settings, nothing worked. It seems that this behavior cannot be ...


6

Whenever you are auditing a new type of application you should look at the other types of vulnerabilities that have been found. A good way of doing this is searching the CVE database. In the case of browser extensions you should look at this Defcon 17 talk: Abusing Firefox Addons. Extensions are given elevated rights, and can be extremely hazardous. In ...


6

Firefox's Sync is a locally AES-256-CBC encrypted database of your stuff (which can include passwords), stored on Mozilla's servers. The key does not leave your browser. But it can be found in every browser you Sync with. The Sync key is stored locally in your passwords. If you don't have a Firefox Master Password, it's not encrypted on your machine. If ...


6

This is the "1/n-1 split" technique which has been deployed in SSL libraries as a workaround for the BEAST attack. The BEAST attack is the application to a Web context of a chosen plaintext attack. The attack works when: The encryption uses a block cipher in CBC mode. The attacker can choose the data that gets encrypted (in a Web context, this is done ...


5

There is one for Chrome, released mid-last year, called XSS ChEF. Based on some earlier work finding vulnerabilities in Chrome extensions. Unfortunately it doesn't seem to be about finding new vulnerabilities but rather an easier way of exploiting/demonstrating them once you have found one. I haven't used it myself but based on the way it works (it's just ...


5

You're protecting two different things. NTFS only provides storage protection. The Firefox master password provides protection in terms of storage, and up to the point of use. Once in use, your filesystem will be decrypted for any application you're running. In contrast, the FF-based encryption will give access to your private key only to FF when it's ...


5

According to my experience it works fine (copy/paste and modify and CP again). However i have change only the name of the field to test a path manipulation. And it was a success. You might have issue with your webapp.


5

Email is usually/historically encrypted using PGP or GPG. There are PGP and GPG addons for most common browsers; You will need to generate a key-pair for yourself and follow basic key-management procedures. This is all fairly long-winded to put into an answer on here, but there are some GUIs available that make the process easier, such as GPG4Win. The ...


5

Firefox isn't “pre-downloading”. You chose to start downloading by selecting “Save Link As” in the menu, or left-clicking on a link whose content type has no internal or external handler. Once Firefox has started downloading, it prompts you for a save location. As long as you haven't entered that location, it downloads the file to a temporary directory ...



Only top voted, non community-wiki answers of a minimum length are eligible