91

We received a message from the IT bods this week stating:

Summary of the issue: IT will disabling and blocking the use of the browser Firefox next Thursday the 03.12.20 on all IT managed devices. Due to certain vulnerabilities and security risks associated with the use of this browser it will be blocked from use as of next Thursday.

Has a new exploit been found? I've checked https://www.mozilla.org/en-US/security/advisories/mfsa2020-50/ but not seen anything that's currently open.

Does anyone know of a reason for this ban?

9
  • 100
    There's almost certainly not a good reason for this and your IT department is just clueless. Nov 29 '20 at 0:15
  • 48
    Have you asked them? You're asking to guess their reasons.
    – schroeder
    Nov 29 '20 at 8:29
  • 6
    @JosephSible-ReinstateMonica not necessarily clueless they might simply want to reduce the software to keep track of. It is a bit telling to single out Firefox of all the browsers (then again, its core features seem to have been a bit neglected for a bit and you kill lots of variants with one go if they also block derivative browsers). Nov 29 '20 at 9:17
  • 68
    That's stupidity if they are allowing Google Chrome. Only Microsoft Edge is updated through Windows update. The real reason is firefox uses its own certificate store which prevents your employer to MITM your traffic without getting detected.
    – defalt
    Nov 29 '20 at 12:52
  • 9
    @defalt Coming soon: Chrome has its own cert store, too.
    – Michael
    Nov 29 '20 at 20:03
161

Assuming that you work in the bank industry, this is likely due to their inability to intercept Firefox's traffic.

Due to Firefox's support of DoH and eSNI most banks and regulated industries are resorting to block Firefox because firewalls can't snoop encrypted traffic easily.

On the other hand, if you use Chrome, IE or Edge, you can push changes through Active Directory without users' knowledge/consent. Actually most hardware firewall vendors with DPI (deep packet inspection) have started to recommend enterprise customers to get rid of Firefox because their edge firewall isn't able to intercept Firefox's traffic any more.

Note: One can enforce policies on Firefox enterprise, but most privacy-conscious users will use Firefox portable to flout it, hence blocking is easier.

  1. https://live.paloaltonetworks.com/t5/blogs/protecting-organizations-in-a-world-of-doh-and-dot/bc-p/319542
  2. https://www.venafi.com/blog/fight-over-dns-over-https
  3. https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk98025
1
  • Comments are not for extended discussion; this conversation has been moved to chat.
    – Rory Alsop
    Dec 1 '20 at 12:32
58

TLDR - It might not be even about security. This could just be due to your company's preference.

A friend of mine faced a similar issue. Firefox is blocked on his office laptop. When asked they simply said it was for "security reasons". After filing request that he needs to test the websites on Firefox, he got a different answer. It stated that they had an extension installed on Google Chrome to monitor their web activity and determine "work time/productivity". The extension was made available on Google Chrome only and all other browsers are banned citing "security reasons", while in reality it is just a preference of the extension development team.

4
  • 22
    That is "security reasons", the problem being that Firefox is secure.
    – OrangeDog
    Nov 30 '20 at 13:03
  • I should note that this reasoning is rather sloppy as well. With Windows Administrator rights you can silently push monitoring software to employee machines that work at the OS level to monitor usage (i.e. it doesn't matter what browser you use). Plugins are fiddly things that don't always work the way you expect.
    – Machavity
    Nov 30 '20 at 13:13
  • @Machavity There was a Windows program that ran alongside the extension. The extension was collecting history from the browser. I suspect that is it used for some analytics like what websites the employees spent their time on, etc... while the windows program was collecting details about what program was being used.
    – Kolappan N
    Nov 30 '20 at 13:20
  • @KolappanN Ah, it was profiling via JavaScript. That would make sense
    – Machavity
    Nov 30 '20 at 13:21
13

Most likely IT didn't want to be responsible for centralized updates.

Without concerted updates individual installations fall out of date and vulnerabilities, once found, may remain unpatched. So they banned it rather than taking on the extra work of making sure it got patched.

20
  • 9
    What's sad is that it's not even any extra work. They just have to not disable the automatic updates that are enabled by default. Nov 29 '20 at 2:50
  • 1
    @JosephSible-ReinstateMonica but people can install mods and somehow fuck the browser up or use adblockers and js blockers and then ask IT why this and that page not works etc. So if they are responsible that stuff works and FF is an additional browser option it might just be their way to reduce overall user support effort. Nov 29 '20 at 9:30
  • 4
    @JosephSible-ReinstateMonica , automated updates can be a serious issue for companies - if suddenly (badly-written own) business critical applications fail (in the newest browser version), the company could be dead in the water for days, not being able to execute. Sure, not the browser's fault, but reality.
    – Aganju
    Nov 29 '20 at 17:46
  • 4
    @Joseph, Firefox lacks the ability to self-update when it isn't in use, which is a problem in an enterprise environment. I'm not aware of any good way to keep it up to date across an entire fleet, even if you can afford the effort. My organization is considering partially dropping support for this reason. Nov 30 '20 at 2:49
  • 2
    Meh, centralized control of Firefox is pretty straightforward these days. Nov 30 '20 at 17:50
2

TLDR - It's remotely possible that Firefox's implementation of Javascript is incompatible with some other part of the organization's infrastructure, or insecure in a very narrow way.

Javascript implementation is my daily headache, in that I support a framework that is intended to work identically no matter how you access it. Problems arise infrequently around some third party content pieces.

Off the top of my head, Firefox is probably the only remaining major browser that can still use a pagehide or unload events to do anything that actually posts back data, or do anything more complicated than confirm navigation away. Chrome and every version of IE or Edge I support doesn't allow a post during those events (to prevent the JS from hijacking a zombie tab). When Firefox encounters that event, there is no issue at all with the data post. In my case, my code actually owns what's in that post, but the content could write basically whatever it wants into a pagehide event and, with Firefox, it'll probably go through if it's fast enough.

Another thing I just thought of is string templating in JS. IE in no way supports it, and some of my clients mandate browser usage around that. I don't use JS string templating because I must support IE back to IE9, but it stands as an example of how browser bans may not be security related. There's this narrow chance that an inbound piece of infrastructure might simply not be compatible in some way they haven't been inclined to mention.

-2

They maintain company sites and/or tools which work with browsers, don't want to support Firefox, and don't want to deal with support requests from unaware Firefox users.

They may be unaware of any damage beyond aesthetic preference. Or not care.

1
  • 6
    That's not a "security reason" or "vulnerability"
    – schroeder
    Nov 30 '20 at 18:13
-18

Maybe they see a different kind of security risk? The Mozilla foundation has been pushing a political agenda lately and I got a push message from the Firefox app on my iPhone asking me to support the #defundfacebook campaign. While one could agree with their agenda, it might be seen as a security/legal risk to allow apps from activistic companies.

7
  • 21
    Are you sure the message was from Mozilla and not from an ad network?
    – schroeder
    Nov 29 '20 at 8:27
  • 15
    Even if you correct the hashtag in your post, #StopHateForProfit is not a political agenda and it's not activistic. And your comment makes things confusing. You say that you got a message from the app, but you never used the app?
    – schroeder
    Nov 29 '20 at 9:06
  • 9
    @schroeder good or bad, right or wrong, effective or not, of course #StopHateForProfit is political and activist (but mostly virtue signaling). To believe otherwise is delusional.
    – RonJohn
    Nov 30 '20 at 0:59
  • 3
    @schroeder what would you call it if not activist?!
    – Tim
    Nov 30 '20 at 9:26
  • 3
    If you feel that your answer has been unfairly received, you could always edit it to clarify the mistakes that are prompting negative attention. We're not trying to be unfair, or to prompt an emotional reaction. The problem here is that you're suggesting a company has done one (very controversial) thing, when they did something much different. It's not "trolling" when your post is questioned due to its ambiguous wording and clarifications. This site isn't for speculation and commenting on problems; it's for definitive answers. Nov 30 '20 at 21:01

Not the answer you're looking for? Browse other questions tagged or ask your own question.