Hot answers tagged

55

Sounds like there is some confusion over the protections that different parts of your system provide. HSTS enforces HTTPS for users who have previously visited the site over HTTPS, for a given period. If a user has never visited the HTTPS version of a site, and the site is also available over HTTP (without a redirect to HTTPS), it will do nothing - the ...


34

You can prevent Ghostery from selling your data by opting out of the Ghost Rank feature. The feature is opt-in, so if you didn't already opt in there is nothing you need to do. It is then safe for you to use. Using a clone of Ghostery which is identical in every aspect except not having the Ghost Rank feature would make no practical difference from running ...


29

Another plugin worth mentioning is Privacy Badger. It's fairly new, but from the EFF, to which I would trust not to do any bad stuff. It's also fairly intelligent since it's not using Blacklist which is always a race against tracker vendors, but uses an algorithm to determine what it should block. I'm using it and am pretty happy with it. The only downside ...


27

You cannot assume that an add-on is safe "because it's hosted in one of the official extension galleries". In this answer, I start with the explanation of how extensions end up in the extension galleries for the popular browsers. At the end, I dedicate an extra section to Chrome. How does an item get listed in the official stores? Anyone with Google ...


25

When the profile is initialized, a blank password (an empty string) is used. You can find the code for this in toolkit/components/passwordmgr/crypto-SDR.js on line 64: if (token.needsUserInit) { this.log("Initializing key3.db with default blank password."); token.initPassword(""); } Additionally, based on the import method in ...


23

I actually think the Mozilla devs have been pretty smart with this. Historically, most PDF exploits have come from the rendering engine rather than the parsing side. Adobe got wise early to the fact that malformed structure and content would screw them, and put a lot of effort into making sure that their parsing engine was rock solid. If you look at some of ...


21

There are many scripts and projects to help site owners detect AdBlock Plus, but I think you're interested in how they work. The idea is simple. The website loads a JavaScript file called ads.js (or any other name that AdBlock Plus finds "attractive"), which contains: var amIHere = document.createElement("div"); amIHere.setAttribute("id", "amIHere"); ...


21

No Firebug doesn't decrypt SSL traffic. Firebug just remind of one key detail: a SSL connection provides a protection against eavesdropping on the connection path. SSL should be seen as a crypted tunnel (VPN is another one), but on both ends of the tunnel, everything is in full light: in clear. Firebug isn't a vulnerability at all.


19

Technically, the popup does not ask you whether you really want to download the file; that decision, you already took when you clicked on the link which triggered the download. The popup asks you what Firefox should do with the file when it has been fully downloaded. Potentially hostile files can be a security issue. Filesystems normally store files as ...


17

I agree with RobM. So it would be possible that they share everything they know about me with (american) governmental organizations. Yes, very possible. Are there even alternative browsers which wouldn't do this? The Onion Router. There may be others. Even Firefox will work this way if you use local syncing, and disable malware and phishing ...


12

I'm guessing that uninstalling IE is impossible or impractical. Go to Control Panel -> Uninstall a program -> Turn Windows features on or off. There you can deselect Internet Explorer. You need to harden IE as well. An application could launch or embed an IE window that could then be used to gain control of the system. Consider this attack: an attacker ...


12

Exploits fall into roughly two distinct categories: those which break the semantic rules of the implementation language (buffer overflows, use-after-free, uncontrolled type casts...) and those which play "by the rules". Since the new PDF reader is written in Javascript, exploits from the first category ought to be extremely rare, because of the intrinsic ...


12

IMPORTANT: This is in noway a full list of the things you should look for, use this answer as an example, a first step in your path and research on your own. I've had a similar task long time ago. I had to security-wise review the code of a Firefox addon, I'm sure you'll easily find Chrome/other browsers' equivalents. Also have in mind the Extensions in ...


12

Is this a problem with my browser? Firefox 39 and the Firefox 31 and 38 ESR releases upgrade the TLS implementation NSS to version 3.19.1. To harden the browser against Logjam attack the minimum key length for DH parameter within the TLS handshake is now 1023 bits. But the server at acs.onlinesbi.com only uses a DH key of 768 bit. This key length is ...


11

Looks like the certificate is only valid for opensource.apple.com, not www.opensource.apple.com: www.opensource.apple.com uses an invalid security certificate. The certificate is only valid for opensource.apple.com (Error code: ssl_error_bad_cert_domain) You can simply use the former.


10

Firefox does not support MHT files without addons. It is possible that you have tricked Firefox into opening each MIME object from the MHT file into a new tab. It is doubtful that this could turn into a security flaw. Update: I confirm that behavior with a valid MHT file. It is a Firefox configuration issue. By default, Firefox will not recognize the ...


9

In Firefox: Yes, absolutely. Nothing about the Firefox architecture prevents them from doing so. While the passwords are in theory "encrypted" while stored on disk, the decryption key is also stored on disk. Therefore, any software with access to the filesystem will find it trivial to decrypt the stored passwords and access them. (If you don't want to ...


9

When compromised you should re-install your machine completely. There is no way of knowing for sure that nothing else has been compromised.


9

WebRTC is a P2P technology and performs encryption end-to-end by default. No metadata on Mozilla's servers. Per session encryption, so Mozilla cannot decrypt. There may be some vulnerabilities with the technology (i.e. there are), but the design is supposed to address your questions on an architectural level.


8

Read this document. Relevant excerpt (page 3): The Firefox platform has no mechanisms to restrict the privileges of add-ons. The add-on code is fully trusted by Firefox. The installation of malicious add-ons can result in full system compromise. There is no security measure to restrict the intercommunication between add-ons. As a result an add-on ...


8

Another plugin worth mentioning is Request Policy (Continued). It blocks all requests to domain other than the one shown in the address bar. Directly after installation, some common third party domains are whitelisted. It is probably harder to use than the other plugins, since many web pages do not work without adding some domains to the whitelist (e.g. the ...


7

When I tried downloading from https://www.mozilla.org/en-US/firefox/fx/ I was pointed to http://mirrors.coreix.net once, then http://mozilla.mirror.nexicom.net/, then http://mozilla.c3sl.ufpr.br. Whether this is the way Firefox's download page is supposed to work or not, I do not know myself. A more appropriate way to resolve this though, would be to ask: ...


7

Yes it's possible, even over ssh and quite trivial to do. Enable X11 forwarding over ssh (e.g., -X option), start firefox, go to Preferences -> Security -> Saved Passwords -> Show Saved Passwords. You could also find them in the relevant files in ~/.mozilla/firefox/{ user_profile } specifically key3.db for the encryption key and signons.sqlite for the ...


7

Typically developer versions (called beta editions in the Software Lifecyle) are used to showcase upcoming features. Some of these features haven't gone through the rigorous testing as a stable (Release) version. To illustrate this, here is Chrome's explanation documenting the differences Stable channel: This channel has the full testing of the Chrome OS ...


7

To me, trustworthiness doesn't necessarily require a claim that an organisation will never disclose your details. Rather it means that any claims made should be honest. As a business, Firefox can be compelled by the governments of any countries it operates in to conform with their laws. An organisation that acknowledges this and clearly explains their ...


6

There are two issues here which make me say no you can't trust them 100%. Now the reason being is that you haven't reviewed the code on one side. It might contain some malicious code which was slipped in by a rogue developer or intentionally by the organization. For standard organisations this is normally very uncommon, but there have been cases such as ...


6

Safe Browsing API Google offers Safe Browsing, which uses URL lists as well as heuristics: Safe Browsing works in two ways to help protect you against phishing and malware. First, Google downloads a list of information to your browser about sites that may contain malicious software or engage in phishing. If the URL of the site you're on matches ...


6

To disable it just write about:config in the address bar and search for network.prefetch-next. Set this to false and no pre-downloading should occur. - This does not work on 18.0.2 on Ubuntu or Windows 7, although it is the only method I have found searching the web. I have tried various other settings, nothing worked. It seems that this behavior cannot be ...


6

Whenever you are auditing a new type of application you should look at the other types of vulnerabilities that have been found. A good way of doing this is searching the CVE database. In the case of browser extensions you should look at this Defcon 17 talk: Abusing Firefox Addons. Extensions are given elevated rights, and can be extremely hazardous. In ...


6

Firefox's Sync is a locally AES-256-CBC encrypted database of your stuff (which can include passwords), stored on Mozilla's servers. The key does not leave your browser. But it can be found in every browser you Sync with. The Sync key is stored locally in your passwords. If you don't have a Firefox Master Password, it's not encrypted on your machine. If ...



Only top voted, non community-wiki answers of a minimum length are eligible