Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [firefox]

Firefox is a Web browser that is smaller, faster, and in some ways more secure than the Netscape browser from which much of its code was derived.

0
votes
0answers
60 views

Parrot OS: Proxychains revealing my real IP in firefox

I am using Parrot OS. While using firefox with proxychains, I see that it is still revealing my real IP address, on the contrary, when I am using terminal stuff like, curl ipinfo.io, my IP is ...
1
vote
1answer
51 views

remove untrustworthy CAs from firefox

There are so many CAs in firefox, that are impossible to approve the reliability of all of them. How do I remove all CAs but the biggest ones like Lets Encrypt, Google Trust Services, GlobalSign and ...
0
votes
0answers
44 views

Obtain Browser TLS Diagnostics

I am writing a TLS server in Java that requests (not requires) a client cert. I have a Java TLS client that works fine. But if I point a browser at it (Edge or Chrome) the browser just abruptly ...
2
votes
0answers
24 views

Firefox not deleting login data although being instructed to do so (possible security problem)

On one of my web servers, I have set up a password-protected directory using the well-known .htaccess / .htpasswd mechanism. The web server is run by Apache 2.4.10 under Debian jessie, if that matters....
0
votes
0answers
115 views

Why is Firefox trying to connect to an advertising company

My firewall blocked Firefox from connecting to a site with an invalid security certificate, but why would it want to connect to an advertising site in the first place. Isn't Mozzilla and Firefox all ...
1
vote
1answer
26 views

What happens when a Firefox blocked extension is already installed and enabled/disabled?

Mozilla has been busy blocking Firefox extensions from their ecosystem due to security and privacy concerns. What happens when a blocked Firefox extension is already installed and enabled? What ...
1
vote
1answer
238 views

OWASP ZAP: How to use TLS client certificate authentication?

Is there a way to get OWASP ZAP to send a client certificate? I have an HTTPS website that receives client certificates for authentication. I have the certificates installed in the browser. ...
11
votes
2answers
2k views

Why do Chrome and Firefox report a different server certificate and issuer than OpenSSL?

When I visit https://somesite.org using Chrome or Firefox and inspect the server certificate, everything looks OK to me. I see SSL Server Certificate, CN, O, OU that appears to match somesite.org ...
0
votes
1answer
47 views

Can hackers access Firefoxs login storage through the internet?

Is it possible for hackers to access my Firefox browsers login storage through the internet? For instance if I visit a malicious website?
3
votes
1answer
266 views

Firefox Sync, end-to-end encryption

I'd like to sync my browsing data with multiple devices but I'm sure as hell I don't want to share my data with 3rd parties (whatever they claim). I've read in past that data saved via Firefox Sync ...
1
vote
1answer
80 views

somewhat complex dev domain https on local network cert problems

I was trying to mirror my setup to prod as much as possible so I only serve my dev site over https. The setup goes like this... I have a trusted CA on my machine made by devcert I generated some ...
3
votes
3answers
267 views

Has Firefox become bugless or where are the Firefox CVEs for 2017? [closed]

Through 2016 Firefox had about the same number (or same order of magnitude) of new issues listed as every other browser. Around 100-250. 2017 lists only a single issue https://www.cvedetails.com/...
1
vote
1answer
307 views

Webauthn configuration differences in Firefox

I'm trying to understand what the different configuration elements mean in Mozilla Firefox. There was an announcement recently from Dropbox that they had enabled support for WebAuthn. I tried logging ...
0
votes
1answer
75 views

Is Aria2 downloads detectable by web servers?

A couple of months ago I signed up for a paid online course. Their terms of service indicate that these video lectures are for streamed viewing and not to be downloaded. There's a 2 hour commute from ...
2
votes
1answer
181 views

Firefox sending Application Data in middle of SSL handshake

I am trying to write my own web server in Java 8, and i am running into a very odd problem. Whenever i make an SSL connection with Chrome, it works just fine. When i try with Firefox (59.0.2), i was ...
1
vote
1answer
86 views

Security on passwords stored by Firefox vs password manager

I am wondering about the safety of my passwords stored in FF > 57. I guess passwords stored in a Keepass database file are safe against cracking, as much as possible given its AES algorithm. Are ...
0
votes
1answer
68 views

Security on passwords stored by Firefox, against add-ons

I am wondering how safe are my passwords stored in the passwords manager built into Mozilla Firefox. Currently I am using Firefox Quantum 59.0.2 64-bit under Ubuntu 16.04 in one machine. I guess ...
3
votes
1answer
79 views

How to Send Decoded URI?

I'm working in Burp and received an interesting response when sending a decoded string as a GET request. Copying/pasting the same string into a browser, the string is automatically encoded by the ...
4
votes
1answer
111 views

Are browsers still vulnerable to IDN homograph attacks?

Is it not possible for Chrome and Firefox to protect against this > https://www.аррӏе.com/ Navigating to that above (fake) apple website using Firefox 59.0.2 doesn't actually take me to the apple ...
16
votes
1answer
762 views

Does Mozilla's new “Facebook Container” have any advantages over uBlock Origin?

Yesterday Mozilla launched a new Firefox plugin called Facebook Container: This makes it harder for Facebook to track your activity on other websites via third-party cookies. […] When you ...
1
vote
0answers
30 views

CBC mode in Firefox ciphersuites strings

When viewing Firefox's ciphersuites list, some AES ciphers appears in the following string format: dhe_rsa_aes_128_sha The format does not specify the cipher mode (e.g. CBC). If not specified, does ...
6
votes
2answers
1k views

Can malicious Javascript in local HTML -file send files to internet in Firefox/Chrome?

Download example.html -file from random website to my computer desktop Open example.html -file from desktop with Google Chrome Now Chrome executes javascript from example.html -file that searches ...
2
votes
2answers
307 views

How to confirm if a site is using Device Fingerprinting

Is it possible to confirm if a site is using Device Fingerprinting? When the site owner uses JavaScript, is there something we can look for in the script to confirm if a website is using device ...
3
votes
1answer
350 views

Reducing resolution of timers as mitigation against Meltdown and Spectre

I have read that Firefox' current mitigation against Meltdown and Spectre (from 57.x) consists of the following: The resolution of performance.now() will be reduced to 20µs. The ...
4
votes
1answer
1k views

How does Firefox's “first-party isolation” feature function?

First-party isolation (privacy.firstparty.isolate in about:config, set to false by default) originated from the Tor browser and was recently added to Firefox. Unfortunately I haven't found enough ...
1
vote
0answers
92 views

How does this website check my incognito/private mode? [duplicate]

Searching a word in corpus.byu.edu seems fine. But when I use its search service on Private mode, it gives me the following error Sorry, but if you're in "incognito/private mode" then you need to ...
1
vote
0answers
1k views

Firefox Issue - ssl_error_bad_mac_alert

Accessing amazon.de via Firefox 57, I was recently blocked with the error code ssl_error_bad_mac_alert - see the attached image below: There's limited information regarding the error code in Firefox ...
0
votes
2answers
148 views

Web Proxy through browser vs through system - is there a difference?

I read that when using a web proxy - your ISP can still see the DNS queries so it knows which site you're visiting, just not which pages and the pages' content assuming you're using HTTPS. But what ...
1
vote
1answer
148 views

Indicator of Compromise - Mozilla Firefox - Malware Redirect [closed]

I am having a strange issue where dragging and dropping an email onto a Mozilla Firefox window redirects the first tab to one of several websites, and the second tab opens with some text from the ...
5
votes
1answer
2k views

Why is DigiNotar CA still in my Mozilla Firefox?

I was just checking in my browser trusted certificates and surprisingly I saw that DigiNotar CA is there... as we know DigiNotar suffered a security breach back in 2011. DigiNotar was a Dutch ...
65
votes
6answers
11k views

Are there objective reasons to not allow Google Chrome extensions, but to allow Firefox extensions?

Recently, the company I work for has forbidden usage of any extensions in Chrome. They also do not allow account sync. This affected virtually all Web developers since they use Chrome to test their ...
4
votes
2answers
591 views

Is Firefox nightly good for security and privacy?

Is Firefox Nightly a good browser to use for security and privacy reasons? Because new security and crypto technologies are implemented faster in FF Nightly, but what about 0 Day security issues? ...
2
votes
1answer
1k views

How secure is Kee 2.0 (Firefox 57 addon) with keepass-plugin-rpc compared to LastPass? [closed]

I wish to evaluate two different password security options which at first seem to be distinctly different: a cloud-based password manager a local (non-cloud) password manager However, the twist is ...
-2
votes
2answers
2k views

Chrome and Firefox showing errors even after importing latest CA certificate for Burp Suite

I am using Chrome 61.0.3163.100 and Firefox 39 on Windows 7 32-bit with Burp Suite v1.7. I have imported latest CA certificate for Burp Suite. In spite of which it's not working for sites with HSTS ...
3
votes
1answer
141 views

Firefox ESR storing passwords during session?

Can anyone else reproduce this while having Firefox NEVER remember passwords: open Firefox ESR log into Facebook x out of the Facebook tab open a new tab click on the Facebook thumbnail does it log ...
1
vote
0answers
96 views

Veracrypt Sufficient Enough for Firefox Profile

I was doing some reading about Firefox and using the password manager with a master password(1,2,3). Suppose I want to protect my entire Firefox profile, is using Veracrypt to create a container ...
1
vote
1answer
759 views

Metasploit command shell session died from EOFError

I am using the multi/browser/firefox_webidl_injection exploit to attack Firefox 26 on a linux VM. I have tried using it with the following payloads: 1) firefox/shell_reverse_tcp and 2) generic/...
0
votes
1answer
486 views

“Microsoft Warning Alert” on Ubuntu computer

I get the "Microsoft Warning Alert" popup from firefox on a Linux computer. That scam is described in https://www.bleepingcomputer.com/virus-removal/remove-malicious-pornographic-spyware-riskware-...
1
vote
1answer
114 views

Avast can hijack email content sent through Frirefox?

The other day I send an email through Gmail in Firefox. Right after I clicked "Send" Avast popped up asking if I wanted to include their signature at the bottom of future emails. Surprised, I accepted ...
1
vote
0answers
184 views

Check if a Websocket connection origins from a Chrome extension [closed]

I am writing an application that communicates with a Chrome extension via websocket connection. I wonder if there is a way to detect whether the connection actually origins from the extension. The ...
2
votes
1answer
110 views

Is an improperly configured HTTPS site inherently more dangerous than plain HTTP? [duplicate]

I'm on Firefox 54, and I noticed a site with a bad HTTPS configuration sometimes gets a large warning page, while there is not any such page yet for plain HTTP.
1
vote
1answer
549 views

Can my computer will be compromised by uBlock/Adblock filter list

uBlock is open source and suppose I trust the author. But filter lists are something that is maintained by other people. Is it possible to add something to filter list to compromise computer/browser, ...
2
votes
1answer
652 views

Is it possible for Firefox to detect MITM attacks by the enterprise? [duplicate]

I'm far from a security expert, so the premise of my question might be wrong. If so please let me know. In an enterprise setting, browser users are vulnerable to, and often subjected to, MITM ...
1
vote
1answer
361 views

How to sandbox Firefox ESR for normal browsing?

I'm running Debian 9.1 with KDE and for security purposes I'd like to run Firefox ESR in a sandboxed mode. However I'd still like to use many normal Firefox features for my normal browsing, download ...
2
votes
1answer
72 views

How can I programatically keep track of number of certificate warnings in browser?

I want to keep a count of how many certificate warnings have been made in the browser over a period of several weeks. I also want to keep track of whether the user ignored these warnings and just ...
64
votes
2answers
9k views

Why is Firefox (and only Firefox) reporting that my connection is insecure on multiple sites?

After installing Firefox 54.0.1 on my work laptop, the first page I see warns me that "Your connection is not secure" when opening https://www.mozilla.org/. "The owner of Firefox has configured their ...
67
votes
1answer
10k views

Why is there no certificate error while visiting google.net although it presents a certificate issued to google.com?

The following output shows that google.net is presenting a certificate that has been issued to www.google.com. $ openssl s_client -connect google.net:443 < /dev/null > out.txt 2>&1; cat ...
1
vote
0answers
208 views

Frequent heavy CPU load from firefox browser -> malware? [closed]

Since recently I started to get very heavy CPU load on my 64bit Debian 9.0 Cinnamon machine. I have all my packages up to date including Firefox-ESR. Often the load is so heavy that I can hear my CPU. ...
2
votes
4answers
356 views

Should I be concerned about Wayback Machine trying to load scripts from unauthenticated sources?

I regularly use Wayback Machine to help find archived versions of webpages that have been taken down or are other otherwise unavailable. While using the site, I noticed a peculiar warning in Google ...
2
votes
1answer
4k views

Why is firefox attempting to direct me to a Captive Portal, when I'm connected to my own router?

I am connected to my own router, and I know for a fact that I do not have a captive portal installed. Firefox displays a banner at the top of the page saying that "you must log in to this network ...