Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [firefox]

Firefox is a Web browser that is smaller, faster, and in some ways more secure than the Netscape browser from which much of its code was derived.

1
vote
0answers
12 views

How to change cipher & elliptical curve priority/order in Firefox? [migrated]

Bugzilla.mozilla.org dev's suggest this was added a couple of years ago (references below) however I see no information anywhere or any options under about:config to accomplish this... I only see ...
-2
votes
0answers
35 views

NoScript(Firefox plugin) in terms of security?

Encode them before executing the page on the user’s web browser (i.e. NoScript - Firefox plugin) I'm reading about XSS defenses, the slide describes the quote as "proxy-based XSS defense". How can ...
0
votes
0answers
10 views

Prevent FireFox using file:///c:/windows/ to open the path [migrated]

I'm trying to help a project team lock down terminal services, in particular FireFox and Chrome open file paths from the browser. We have successfully locked IE from opening the path using Citrix ...
1
vote
1answer
115 views

Do I understand SHA-1 brute-forcing speeds correctly? (Firefox Password Manager)

I read that the Firefox Password Manager has a "bug" (or rather poor design) in that it uses only a single sha-1 hash iteration for the password (which makes it extremely easy to brute-force ...
0
votes
1answer
34 views

Is it safe to browse the web through an SSH SOCKS5 connection to an untrusted proxy?

I have established an SSH tunnel to an untrusted machine: ssh -N -D 12345 john@example.com Next, I set up Firefox's connection settings to use the SSH tunnel by setting the SOCKS host to 127.0.0.1, ...
2
votes
1answer
57 views

Firefox warning: Content Security Policy: Couldn’t process unknown directive ‘require-sri-for’

Why does Firefox tell me Content Security Policy: Couldn’t process unknown directive ‘require-sri-for’ when Mozilla's documentation says they've implemented it? The meta tag Firefox is ...
2
votes
1answer
60 views

How can I block access to module for Firefox? (gmail accessing camera)

I run the following command in the background constantly to check for camera access on Ubuntu Linux: lsmod | grep ^uvcvideo I noticed that every time I load into gmail my check is triggering my ...
1
vote
1answer
129 views

Firefox is uploading lots of data during startup

Firefox is uploading lots of data during startup to servers like ec2-52-89-171-193.us-west-2.compute.amazonaws.com.https. Is there a way to find what data are being uploaded to any particular server ...
2
votes
1answer
95 views

I found a browser extension I don't trust installed, should I worry?

Someone told me that their Firefox had a strange new menu bar. I found that it was “FindYourMaps”. FindYourMaps is a deceptive browser toolbar that supposedly allows users to find driving ...
1
vote
1answer
94 views

How exposed am I using older Firefox version (56)?

Due to one add-on not being compatible with newer Firefox versions (57 and up), I'm stuck with Firefox 56 (running on Debian) for a while. I'm OK with things like performance or looks not being the ...
5
votes
1answer
689 views

Danger of browser extension without any permissions?

Assuming that an extension for Firefox or Chrome does not request any WebExtensions permission, what harm could this extension do? Or put another way: What (potentially malicious) actions can an ...
1
vote
0answers
112 views

Lowering Firefox sandbox settings to enable use of Sandboxie

As discussed on the official forum, to use Firefox 60+ with Sandboxie, Firefox's security.sandbox.content.level needs to be lowered to level 2. Now my concern is that the lowered sandbox content ...
2
votes
1answer
76 views

remove untrustworthy CAs from firefox

There are so many CAs in firefox, that are impossible to approve the reliability of all of them. How do I remove all CAs but the biggest ones like Lets Encrypt, Google Trust Services, GlobalSign and ...
3
votes
0answers
35 views

Firefox not deleting login data although being instructed to do so (possible security problem)

On one of my web servers, I have set up a password-protected directory using the well-known .htaccess / .htpasswd mechanism. The web server is run by Apache 2.4.10 under Debian jessie, if that matters....
1
vote
0answers
239 views

Why is Firefox trying to connect to an advertising company?

My firewall blocked Firefox from connecting to a site with an invalid security certificate. But why would it want to connect to an advertising site in the first place? Isn't Mozzilla and Firefox all ...
1
vote
1answer
29 views

What happens when a Firefox blocked extension is already installed and enabled/disabled?

Mozilla has been busy blocking Firefox extensions from their ecosystem due to security and privacy concerns. What happens when a blocked Firefox extension is already installed and enabled? What ...
1
vote
1answer
560 views

OWASP ZAP: How to use TLS client certificate authentication?

Is there a way to get OWASP ZAP to send a client certificate? I have an HTTPS website that receives client certificates for authentication. I have the certificates installed in the browser. ...
11
votes
2answers
2k views

Why do Chrome and Firefox report a different server certificate and issuer than OpenSSL?

When I visit https://somesite.org using Chrome or Firefox and inspect the server certificate, everything looks OK to me. I see SSL Server Certificate, CN, O, OU that appears to match somesite.org ...
0
votes
1answer
47 views

Can hackers access Firefoxs login storage through the internet?

Is it possible for hackers to access my Firefox browsers login storage through the internet? For instance if I visit a malicious website?
3
votes
1answer
642 views

Firefox Sync, end-to-end encryption

I'd like to sync my browsing data with multiple devices but I'm sure as hell I don't want to share my data with 3rd parties (whatever they claim). I've read in past that data saved via Firefox Sync ...
1
vote
1answer
123 views

somewhat complex dev domain https on local network cert problems

I was trying to mirror my setup to prod as much as possible so I only serve my dev site over https. The setup goes like this... I have a trusted CA on my machine made by devcert I generated some ...
3
votes
3answers
272 views

Has Firefox become bugless or where are the Firefox CVEs for 2017? [closed]

Through 2016 Firefox had about the same number (or same order of magnitude) of new issues listed as every other browser. Around 100-250. 2017 lists only a single issue https://www.cvedetails.com/...
1
vote
1answer
531 views

Webauthn configuration differences in Firefox

I'm trying to understand what the different configuration elements mean in Mozilla Firefox. There was an announcement recently from Dropbox that they had enabled support for WebAuthn. I tried logging ...
0
votes
1answer
91 views

Is Aria2 downloads detectable by web servers?

A couple of months ago I signed up for a paid online course. Their terms of service indicate that these video lectures are for streamed viewing and not to be downloaded. There's a 2 hour commute from ...
2
votes
1answer
275 views

Firefox sending Application Data in middle of SSL handshake

I am trying to write my own web server in Java 8, and i am running into a very odd problem. Whenever i make an SSL connection with Chrome, it works just fine. When i try with Firefox (59.0.2), i was ...
1
vote
1answer
110 views

Security on passwords stored by Firefox vs password manager

I am wondering about the safety of my passwords stored in FF > 57. I guess passwords stored in a Keepass database file are safe against cracking, as much as possible given its AES algorithm. Are ...
0
votes
1answer
78 views

Security on passwords stored by Firefox, against add-ons

I am wondering how safe are my passwords stored in the passwords manager built into Mozilla Firefox. Currently I am using Firefox Quantum 59.0.2 64-bit under Ubuntu 16.04 in one machine. I guess ...
3
votes
1answer
95 views

How to Send Decoded URI?

I'm working in Burp and received an interesting response when sending a decoded string as a GET request. Copying/pasting the same string into a browser, the string is automatically encoded by the ...
4
votes
1answer
160 views

Are browsers still vulnerable to IDN homograph attacks?

Is it not possible for Chrome and Firefox to protect against this > https://www.аррӏе.com/ Navigating to that above (fake) apple website using Firefox 59.0.2 doesn't actually take me to the apple ...
16
votes
1answer
1k views

Does Mozilla's new “Facebook Container” have any advantages over uBlock Origin?

Yesterday Mozilla launched a new Firefox plugin called Facebook Container: This makes it harder for Facebook to track your activity on other websites via third-party cookies. […] When you ...
1
vote
0answers
34 views

CBC mode in Firefox ciphersuites strings

When viewing Firefox's ciphersuites list, some AES ciphers appears in the following string format: dhe_rsa_aes_128_sha The format does not specify the cipher mode (e.g. CBC). If not specified, does ...
6
votes
2answers
2k views

Can malicious Javascript in local HTML -file send files to internet in Firefox/Chrome?

Download example.html -file from random website to my computer desktop Open example.html -file from desktop with Google Chrome Now Chrome executes javascript from example.html -file that searches ...
2
votes
2answers
425 views

How to confirm if a site is using Device Fingerprinting

Is it possible to confirm if a site is using Device Fingerprinting? When the site owner uses JavaScript, is there something we can look for in the script to confirm if a website is using device ...
3
votes
1answer
424 views

Reducing resolution of timers as mitigation against Meltdown and Spectre

I have read that Firefox' current mitigation against Meltdown and Spectre (from 57.x) consists of the following: The resolution of performance.now() will be reduced to 20µs. The ...
5
votes
1answer
1k views

How does Firefox's “first-party isolation” feature function?

First-party isolation (privacy.firstparty.isolate in about:config, set to false by default) originated from the Tor browser and was recently added to Firefox. Unfortunately I haven't found enough ...
1
vote
0answers
99 views

How does this website check my incognito/private mode? [duplicate]

Searching a word in corpus.byu.edu seems fine. But when I use its search service on Private mode, it gives me the following error Sorry, but if you're in "incognito/private mode" then you need to ...
1
vote
0answers
2k views

Firefox Issue - ssl_error_bad_mac_alert

Accessing amazon.de via Firefox 57, I was recently blocked with the error code ssl_error_bad_mac_alert - see the attached image below: There's limited information regarding the error code in Firefox ...
0
votes
2answers
156 views

Web Proxy through browser vs through system - is there a difference?

I read that when using a web proxy - your ISP can still see the DNS queries so it knows which site you're visiting, just not which pages and the pages' content assuming you're using HTTPS. But what ...
1
vote
1answer
181 views

Indicator of Compromise - Mozilla Firefox - Malware Redirect [closed]

I am having a strange issue where dragging and dropping an email onto a Mozilla Firefox window redirects the first tab to one of several websites, and the second tab opens with some text from the ...
10
votes
1answer
4k views

Why is DigiNotar CA still in my Mozilla Firefox?

I was just checking in my browser trusted certificates and surprisingly I saw that DigiNotar CA is there... as we know DigiNotar suffered a security breach back in 2011. DigiNotar was a Dutch ...
65
votes
6answers
12k views

Are there objective reasons to not allow Google Chrome extensions, but to allow Firefox extensions?

Recently, the company I work for has forbidden usage of any extensions in Chrome. They also do not allow account sync. This affected virtually all Web developers since they use Chrome to test their ...
4
votes
2answers
652 views

Is Firefox nightly good for security and privacy?

Is Firefox Nightly a good browser to use for security and privacy reasons? Because new security and crypto technologies are implemented faster in FF Nightly, but what about 0 Day security issues? ...
2
votes
1answer
1k views

How secure is Kee 2.0 (Firefox 57 addon) with keepass-plugin-rpc compared to LastPass? [closed]

I wish to evaluate two different password security options which at first seem to be distinctly different: a cloud-based password manager a local (non-cloud) password manager However, the twist is ...
-1
votes
2answers
2k views

Chrome and Firefox showing errors even after importing latest CA certificate for Burp Suite

I am using Chrome 61.0.3163.100 and Firefox 39 on Windows 7 32-bit with Burp Suite v1.7. I have imported latest CA certificate for Burp Suite. In spite of which it's not working for sites with HSTS ...
3
votes
1answer
158 views

Firefox ESR storing passwords during session?

Can anyone else reproduce this while having Firefox NEVER remember passwords: open Firefox ESR log into Facebook x out of the Facebook tab open a new tab click on the Facebook thumbnail does it log ...
1
vote
0answers
117 views

Veracrypt Sufficient Enough for Firefox Profile

I was doing some reading about Firefox and using the password manager with a master password(1,2,3). Suppose I want to protect my entire Firefox profile, is using Veracrypt to create a container ...
1
vote
1answer
852 views

Metasploit command shell session died from EOFError

I am using the multi/browser/firefox_webidl_injection exploit to attack Firefox 26 on a linux VM. I have tried using it with the following payloads: 1) firefox/shell_reverse_tcp and 2) generic/...
0
votes
1answer
628 views

“Microsoft Warning Alert” on Ubuntu computer

I get the "Microsoft Warning Alert" popup from firefox on a Linux computer. That scam is described in https://www.bleepingcomputer.com/virus-removal/remove-malicious-pornographic-spyware-riskware-...
1
vote
1answer
116 views

Avast can hijack email content sent through Frirefox?

The other day I send an email through Gmail in Firefox. Right after I clicked "Send" Avast popped up asking if I wanted to include their signature at the bottom of future emails. Surprised, I accepted ...
1
vote
0answers
218 views

Check if a Websocket connection origins from a Chrome extension [closed]

I am writing an application that communicates with a Chrome extension via websocket connection. I wonder if there is a way to detect whether the connection actually origins from the extension. The ...