Hot answers tagged firefox
20
I actually think the Mozilla devs have been pretty smart with this.
Historically, most PDF exploits have come from the rendering engine rather than the parsing side. Adobe got wise early to the fact that malformed structure and content would screw them, and put a lot of effort into making sure that their parsing engine was rock solid. If you look at some of ...
14
Technically, the popup does not ask you whether you really want to download the file; that decision, you already took when you clicked on the link which triggered the download. The popup asks you what Firefox should do with the file when it has been fully downloaded.
Potentially hostile files can be a security issue. Filesystems normally store files as ...
12
I'm guessing that uninstalling IE is impossible or impractical.
Go to Control Panel -> Uninstall a program -> Turn Windows features on or off. There you can deselect Internet Explorer.
You need to harden IE as well. An application could launch or embed an IE window that could then be used to gain control of the system. Consider this attack: an attacker ...
11
Firefox does not support MHT files without addons.
It is possible that you have tricked Firefox into opening each MIME object from the MHT file into a new tab. It is doubtful that this could turn into a security flaw.
Update:
I confirm that behavior with a valid MHT file. It is a Firefox configuration issue. By default, Firefox will not recognize the ...
11
Exploits fall into roughly two distinct categories: those which break the semantic rules of the implementation language (buffer overflows, use-after-free, uncontrolled type casts...) and those which play "by the rules". Since the new PDF reader is written in Javascript, exploits from the first category ought to be extremely rare, because of the intrinsic ...
7
When I tried downloading from https://www.mozilla.org/en-US/firefox/fx/ I was pointed to http://mirrors.coreix.net once, then http://mozilla.mirror.nexicom.net/, then http://mozilla.c3sl.ufpr.br. Whether this is the way Firefox's download page is supposed to work or not, I do not know myself.
A more appropriate way to resolve this though, would be to ask: ...
6
To disable it just write about:config in the address bar and search for network.prefetch-next.
Set this to false and no pre-downloading should occur. - This does not work on 18.0.2 on Ubuntu or Windows 7, although it is the only method I have found searching the web. I have tried various other settings, nothing worked. It seems that this behavior cannot be ...
5
Email is usually/historically encrypted using PGP or GPG. There are PGP and GPG addons for most common browsers;
You will need to generate a key-pair for yourself and follow basic key-management procedures. This is all fairly long-winded to put into an answer on here, but there are some GUIs available that make the process easier, such as GPG4Win.
The ...
4
Maybe it's best to explain the problem with mixed content.
A lot of websites will store the login state into the session, and if an attacker has the session-id, he can impersonate the logged in user. The session-id must be sent along with each request, so the server can recognize the user, this will usually be done with a cookie containing the session-id.
...
4
Yes, it does add to security and yes it should be done but security is often neglected over usability.
For example the Chrome notification is barely even present as opposed to the firefox popup. More importantly, to actually prevent such a threat the browser must not only notify the average user (who would have no idea what's doing on) but also give the ...
4
You're protecting two different things. NTFS only provides storage protection. The Firefox master password provides protection in terms of storage, and up to the point of use.
Once in use, your filesystem will be decrypted for any application you're running. In contrast, the FF-based encryption will give access to your private key only to FF when it's ...
4
Javascript can read password dialogs just like any other field:
document.getElementsByName("passwordentry")[0].value
so you can certainly have a piece of javascript that checks if the password field has been filled in much faster than humanly possible, as long as the user has javascript enabled..
You may want to implement a proof-of-concept to see how ...
4
Yes it's possible, even over ssh and quite trivial to do. Enable X11 forwarding over ssh (e.g., -X option), start firefox, go to Preferences -> Security -> Saved Passwords -> Show Saved Passwords.
You could also find them in the relevant files in ~/.mozilla/firefox/{ user_profile } specifically key3.db for the encryption key and signons.sqlite for the ...
4
Canvas is a feature that allows a website to generate graphics dynamically, at client-side, right in front of your eyes.
It is harmless, but there is a process named Canvas Fingerprinting where some Canvas features can be used to obtain detailed information about your Browser, like what your browser is and what exact version, whats your OS, what fonts you ...
3
Firefox isn't “pre-downloading”. You chose to start downloading by selecting “Save Link As” in the menu, or left-clicking on a link whose content type has no internal or external handler. Once Firefox has started downloading, it prompts you for a save location. As long as you haven't entered that location, it downloads the file to a temporary directory ...
3
Another alternative is to use Portal Based Encryption, where the public keys are maintained in a central repository and a webserver hosts the public keys.
Examples:
1) Zixmail
2) Proofpoint Secure Email
Each of these products act as an SMTP relay of sorts and allow you to send mail to it from any system.
For the Proofpoint system they will receive a ...
3
I can imagine certain conditions for this to become a security issue:
The browser downloads the file that triggers a vulnerability in the file browser like the WMF vulnerability
A virus scanner might start scanning the partially downloaded file and it could trigger a vulnerability in the scanner. Sophos had some bad press recently.
A huge file that is ...
3
I'd say it's equally secure. If you forget to lock your computer when you go away someone could access that folder because it will not be encrypted anymore. However if you forget to lock your computer you might leave your browser opened as well after you introduced the master password.
If your system gets compromized (for instance remote access by ...
3
The "master password" that Firefox allows you to set, when remembering passwords for sites, is also used to protect the private keys for personal certificates (that is, they are encrypted with a key derived from that master password). Firefox may fail to suggest setting such a password when generating a new key if you instructed it not to use one.
Note that ...
3
The server is misconfigured. It is not serving the full certificate chain.
This issue is immediately identified by standard SSL server verification services. For example:
SSL Labs reports "Chain issues: Incomplete."
GlobeSSL reports "Your certificate is not installed correctly. Make sure you have installed all necessary intermediate ...
3
The HTTP server may not be serving the intermediate certificates. Try using openssl s_client to verify what certificates do you get:
openssl s_client -connect www.google.com:443 -showcerts -CApath /etc/ssl/certs/
will print certificates between
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
You can then save those lines to a file, /tmp/a.pem in ...
3
You are mixing the "session" as the current identifier of your browser/you in a web application, and the session of the user in her computer, meaning all the tabs opened.
Now for your other questions :
If I stop the computer with my web-app, and then start it again before
the timeout set on the session on the server expires, then anybody
that starts ...
3
PDF exploits are not exploiting the PDF file format. Instead, they are exploiting vulnerabilities found in the PDF reader.
If a PDF files contains an exploit for Adobe's reader, opening the file using pdf.js will prevent the exploit from working. Assuming Mozilla is fixing the bugs in pdf.js on a regular basis, this can reduce the impact of PDF exploits.
...
2
It's not a bug, it's a feature. It might be abused for evil purposes, or misused by developers.
Install NoScript addon, no flash plugin will fire itself up without your consent. This is why firefox will always be more secure than Chrome, alternatives are not up to the task yet and for some reasons it takes time for google developers to provide the necessary ...
2
Usually it is possible to modify the POST request by copy/pasting into a text editor. But not always, I find it will often cause problems when posting JSON. This process can also damage the content-type and content-size, although it usually fixes this for you (but it is unreliable).
In general I find standalone proxies to be easier to use and more ...
2
The SSL certificate to authenticate to startSSL is like a key, FF does provide a way for someone with access to the machine to export the keys, unless you set the password manager's password. (see Thomas Pornin)
If that password is not set you will be dependable on your OS security.
2
Yes it is possible for a webpage to retrieve the content of a password-field via JavaScript, just as most autofill-addons use JavaScript to insert the password based on the URL and the input-type or id of the password-field.
The following function prints all the passwords on the current page, if there is any, and could easily be modified to just check if a ...
2
Identifying the problem certificate
When next you visit a site that shows that error, have a look at the certificate chain, it should something like:
If it doesn't, that is, if something in that line is a problem, it should identify the expired issuer certificate or the like.
Reasons for a problem certificate
It is possible that this is evidence of a ...
2
This a long standing security bug of Firefox which is at least around since 2008.
For example see https://bugzilla.mozilla.org/show_bug.cgi?id=443354#c48 ("Save and Quit tabs should not save session cookies of to-be-restored tabs").
Further details and a workaround are also described at
https://support.mozilla.org/de/questions/938865 in "Firefox doesn't ...
Only top voted, non community-wiki answers of a minimum length are eligible
