Questions tagged [firefox]

Firefox is a Web browser that is smaller, faster, and in some ways more secure than the Netscape browser from which much of its code was derived.

Filter by
Sorted by
Tagged with
5
votes
3answers
368 views

Why are many US Department of Defense certificates not trusted by Firefox?

There are a number of US Department of Defense (DoD) websites that I need to access on a regular basis (e.g., https://ataaps.csd.disa.mil/ and https://web.mail.mil) that Firefox issues a Warning: ...
37
votes
1answer
5k views

Can a browser extension (Chrome, Firefox, etc.) read the web console log?

I realized that my bank handles sensitive information in the web console log, so my concern is if any browser extension could read the log?
0
votes
2answers
175 views

Why does Firefox (version 71.0 (64-bit)) indicate “weak encryption” but Google Chrome (Version 79.0.3945.88) does not?

I read that Mozilla uses its own trust certificate store but does "weak encryption" have anything to do with whether the browser trusts the certificate? Has it got anything to do with the signature ...
9
votes
1answer
358 views

What would happen if some random webpage made an Ajax request for http://127.0.0.1/private.txt?

I run a localhost-only webserver (PHP's built-in one) for all my admin panels and whatnot on my machine. I'm worried that, if any random webpage has a JavaScript snippet which makes an Ajax call to ...
7
votes
3answers
369 views

Browser setups to stay safe from malware and unwanted stuff

I have to set up a browser to surf the internet. I'm trying to stay safe from malware as much as possible. (I already know that there's no way to stay 100% safe.) My idea is to use Firefox with these ...
0
votes
1answer
181 views

Purpose of Decrypting & Scanning HTTPS traffic

Navigating to the below URL link from the Mozilla Firefox and entering some website link and clicking on View, displays certificate Viewer chrome://pippki/content/exceptionDialog.xul After enabling ...
3
votes
5answers
1k views

Is Firefox's Lockwise secure?

I have lot's of passwords saved in Firefox Password Manager, now called Lockwise. I recently installed Opera Browser on my machine. It somehow managed to import all the history-data and form fields, ...
2
votes
1answer
131 views

Browser copy function overridden silently, is this security risk?

I came across a site which overrides copy functionality and injects current page url as paste value. I was trying to select couple of words and instead it copied the page link. Simple developer tools ...
8
votes
1answer
172 views

How well do current browsers handle certificate revocation?

I am a Firefox user and recently stumbled upon the Liu, Yabing, et al. "An end-to-end measurement of certificate revocation in the web's PKI." Proceedings of the 2015 Internet Measurement Conference. ...
1
vote
1answer
101 views

Is encrypting the FireFox folder with EFS protecting saved passwords in case of someone accessing the hard drive?

What I want to do: Use the "save password" feature in FireFox (on Windows 10) without using FireFox's master password feature. What I'm afraid of: Someone stealing my laptop or getting access to my ...
0
votes
1answer
95 views

Is there any way to mitigate against a compromised CA as a client on Firefox?

If I, as a client, connect to a server and there is a malicious certificate authority, how can the client protect against this CA and still connect to the site? If this isn't possible, how can the ...
0
votes
1answer
131 views

Is there a way to download the Firefox Phishing and Malware Protection list?

I'm building an app that needs to check bad websites and was wondering if there is a way to download the Firefox bad site list directly outside of the browser? The list is described in the Mozilla.org ...
0
votes
1answer
169 views

Are the privacy features of Firefox 69.0 complementary to PrivacyBadger 2019.7.1.1?

Are the privacy features (blocking of Trackers, Cookies, Cryptominers, Fingerprinters) of Firefox 69.0 complemantary to PrivacyBadger? or do they interfere with each other?
8
votes
1answer
533 views

How are Mozilla Firefox passwords encrypted?

As far as I know, current versions of Mozilla Firefox store the saved passwords (encrypted with 3DES) to the logins.json file meanwhile the keys are stored in key4.db (or key3.db in older versions). ...
0
votes
1answer
407 views

Localhost intercept not working for burp suite [closed]

I configured my Firefox proxy to send my php website traffic running on localhost to burp suite for intercept but its not intercepting anything.My firefox and burpsuite configurations here.I've tried ...
0
votes
1answer
93 views

Firefox Account - Export user data (GDPR)

Is there a way of exporting all user data associated with a Firefox Account? Yes? where can I request/download it? No? isn't right of access a legal requirement under the current GDPR ...
10
votes
1answer
618 views

Firefox bug permits stealing encrypted passwords: How is this possible?

It's my understanding that passwords I save in Firefox's Password Manager are encrypted and that setting a Master Password encrypts the encryption key used in this process. The Google hit for "Does ...
2
votes
1answer
100 views

Firefox 68 — any changes affecting CSRF capabilities?

My Ubuntu 18 system did an upgrade to Firefox 68 (presumably from 67.x). I have a simple XSRF demo that I use for class --- the demo is extremely simple: I have a login program that sets a sessionid ...
6
votes
2answers
1k views

Did google chrome kill public key pinning?

I've read many articles talking about google chrome killing public key pinning in Chrome 67 (May 2018). See here, here, and here. However, I haven't found any information about whether or not they ...
0
votes
0answers
51 views

How to use browser bookmarks more securely?

I have been wondering in how far any tracking sites or other instances could gather information about me through my browser bookmarks (ie. in Firefox). An online search did not result in a lot of ...
0
votes
0answers
114 views

Why does Firefox keep offering “unreputable” add-ons and add-ons that they don't even review?

When I install an add-on to Firefox, choosing it from the ones I find by using the Tools / Add-ons menu, sometimes after a few days Avast pops up a warning that the add-on is "unreputable" and ...
0
votes
0answers
38 views

Browser Exploiting - Using SyncManager to keep Service Workers alive forever

I just read the paper "Master of Web Puppets: Abusing Web Browsers for Persistent and Stealthy Computation". The authors claim to use the SyncManager Interface in order to keep Service Workers alive ...
0
votes
1answer
214 views

Firefox reports every HTTPS page as unsecure in Windows 7 for standard user

I started with looking at this this post as I have exactly the same issue. But I am not on a company network, after a proxy or anything special. I am at home with three computer where Firefox works ...
3
votes
1answer
99 views

What mechanism does Firefox use to remember the in-session logins, after entering the Master Password?

After I have entered my Master Password, does Firefox decrypt all the logins and store them somewhere? Or does it store the Master Password itself? Is the in-session period (more) vulnerable to attack?...
6
votes
1answer
151 views

Information obtained from executing Javascript math functions in browser

I came across interesting piece of javascript across few sites. It's executing Javascript math functions such as abs, acos, random etc. thousands of times - or four thousand times in my case, though ...
1
vote
1answer
129 views

How do I use never remember history in Firefox effectively? [duplicate]

Under Firefox - Privacy and Security, I can change my history settings to never remember, remember, or use custom settings. Right now, I have it set to remember history, under what circumstances is ...
0
votes
0answers
23 views

Automatically notify about certificate changes in Firefox

I have the HTTPS Everywhere add-on for Firefox. I vaguely recall that several years ago either this or another add-on checked whether the CA for a certificate has changed. I'd like to be notified when ...
0
votes
0answers
36 views

Addons still work with Firefox on one account

I'm using Firefox 66.0.3 on Ubuntu, and like everyone else I'm experiencing the certificate bug which causes addons to be disabled. However, in one of my user accounts, the addons still work like a ...
-1
votes
2answers
357 views

Unable to inject cookies

As part of an exercise, I need to sniff cookies from a login page and inject them in the same login page. If the cookie injection is successful the user must be login without entering the user name ...
1
vote
1answer
544 views

How can I inject cookie from Wireshark into a browser sesson [duplicate]

For education and research purpose, I need to inject a cookie value into my browser to allow me login indirectly (without entering the user name and password). I collected traffic during a login ...
1
vote
1answer
113 views

Can my open Firefox Sync session be used to circumvent a Master Password?

In short I'm wondering what's stopping someone with access to my computer account to exploit an open Firefox Sync session to view my synced passwords, even if a Master Password has been set. On this ...
-4
votes
1answer
180 views

How to configure proxy CA certificate in browser? [closed]

I was trying to download burp's CA certificate for Firefox on Kali from http://burp as specified in its documentation but the site is not available. It redirects me to http://www.inert.com/. So is ...
0
votes
2answers
255 views

Does HTTP:// to HTTPS:// redirection means strict HTTPS from server

when I try to connect to some websites using http:// (notice the absence of s) , my client end up with https://. I use python requests for this purpose, which simulate a client behavior. It performs ...
1
vote
1answer
82 views

How to defend myself against potential malicious browser add-ons?

So previously I asked a question about what type of private data can addons extract from my browser : Can a malicious add-on access internet history and such in Chrome/Firefox? and it turns out if ...
3
votes
1answer
119 views

When accepting an SSL certificate, can I limit for which domains I accept it?

Many organizations (e.g. companies, universities, ...) have internal sites and services for which they use SSL certificates issued by an internal CA, that isn't trusted by browsers or operating ...
19
votes
2answers
3k views

Can a malicious add-on access internet history and such in Chrome/Firefox?

How does Chrome/Firefox make sure add-ons are safe? Do they have any protection against a malicious add-on? How much access can add-ons have? Can they access internet history or maybe even cookies ...
9
votes
2answers
3k views

How to prevent Firefox and Chrome from opening ports in the firewall?

I have noticed that Firefox and Chrome have opened ports for unsolicited inbound traffic in the Windows firewall. This happened with Windows 7 x64 and Windows 10. (Here, I am talking about the ...
1
vote
1answer
559 views

Is it safe to use Orbot with the normal Firefox browser on Android

I noticed that when using Orbots "VPN Mode" that my normal Firefox browser works fine and when I visit check.torproject.org it says I'm connected even though I'm not using the Tor Browser specifically....
1
vote
0answers
139 views

Redirection to a blank page after searching on Google with the search bar of Firefox

Today I tried to use the search bar in the top-right side of Firefox (ver 65.0 64-bit on Linux Mint 18.3 Sylvia 64-bit), and the search bar contains "search Google in Traditional Chinese". When I use ...
0
votes
0answers
34 views

Are there any security implications to leaving Firefox's advanced developer tools enabled?

Mozilla's Firefox web browser has two advanced developer tools settings that are disabled by default. To enable them, open the Developer Tools settings, go to the section "Advanced Settings", and ...
0
votes
1answer
450 views

Am I safe after importing Bitdefender's fake certificate?

I installed Bitdefender today and suddenly I couln't navigate to numerous websites that I used to visit (I use Mozilla Firefox). I got the error: SEC_ERROR_UNKNOWN_ISSUER. I searched a bit and found ...
3
votes
0answers
216 views

HTML link with “noopener” and/or “noreferrer” in Chrome/Chromium results in unexpected behaviour

There are several attacks possible when embedding links with target="_blank". This is where rel="noopener" and rel="noreferrer" should help. I am expecting that clicking the following link <a ...
0
votes
1answer
43 views

Firefox switches charset encoding, brings up request to install extensin. Is this a “browser virus”?

I use Devuan ASCII (~= Debian Stretch) on my desktop, with Firefox and Chromium as my browsers. As I came back to my computer today after a few hours of non-use, and loaded a new browser frame, ...
1
vote
1answer
184 views

Do I understand SHA-1 brute-forcing speeds correctly? (Firefox Password Manager)

I read that the Firefox Password Manager has a "bug" (or rather poor design) in that it uses only a single sha-1 hash iteration for the password (which makes it extremely easy to brute-force ...
0
votes
1answer
57 views

Is it safe to browse the web through an SSH SOCKS5 connection to an untrusted proxy?

I have established an SSH tunnel to an untrusted machine: ssh -N -D 12345 john@example.com Next, I set up Firefox's connection settings to use the SSH tunnel by setting the SOCKS host to 127.0.0.1, ...
2
votes
1answer
838 views

Firefox warning: Content Security Policy: Couldn’t process unknown directive ‘require-sri-for’

Why does Firefox tell me Content Security Policy: Couldn’t process unknown directive ‘require-sri-for’ when Mozilla's documentation says they've implemented it? The meta tag Firefox is ...
2
votes
1answer
111 views

How can I block access to module for Firefox? (gmail accessing camera)

I run the following command in the background constantly to check for camera access on Ubuntu Linux: lsmod | grep ^uvcvideo I noticed that every time I load into gmail my check is triggering my ...
1
vote
1answer
150 views

Firefox is uploading lots of data during startup

Firefox is uploading lots of data during startup to servers like ec2-52-89-171-193.us-west-2.compute.amazonaws.com.https. Is there a way to find what data are being uploaded to any particular server ...
2
votes
1answer
108 views

I found a browser extension I don't trust installed, should I worry?

Someone told me that their Firefox had a strange new menu bar. I found that it was “FindYourMaps”. FindYourMaps is a deceptive browser toolbar that supposedly allows users to find driving ...
1
vote
1answer
149 views

How exposed am I using older Firefox version (56)?

Due to one add-on not being compatible with newer Firefox versions (57 and up), I'm stuck with Firefox 56 (running on Debian) for a while. I'm OK with things like performance or looks not being the ...