Questions tagged [firefox]

Firefox is a Web browser that is smaller, faster, and in some ways more secure than the Netscape browser from which much of its code was derived.

0
votes
0answers
97 views

Why does Firefox keep offering “unreputable” add-ons and add-ons that they don't even review?

When I install an add-on to Firefox, choosing it from the ones I find by using the Tools / Add-ons menu, sometimes after a few days Avast pops up a warning that the add-on is "unreputable" and ...
0
votes
0answers
29 views

Browser Exploiting - Using SyncManager to keep Service Workers alive forever

I just read the paper "Master of Web Puppets: Abusing Web Browsers for Persistent and Stealthy Computation". The authors claim to use the SyncManager Interface in order to keep Service Workers alive ...
0
votes
1answer
141 views

Firefox reports every HTTPS page as unsecure in Windows 7 for standard user

I started with looking at this this post as I have exactly the same issue. But I am not on a company network, after a proxy or anything special. I am at home with three computer where Firefox works ...
3
votes
1answer
82 views

What mechanism does Firefox use to remember the in-session logins, after entering the Master Password?

After I have entered my Master Password, does Firefox decrypt all the logins and store them somewhere? Or does it store the Master Password itself? Is the in-session period (more) vulnerable to attack?...
0
votes
0answers
24 views

Browser security in connection to multiple browser tabs [duplicate]

Can a Firefox browser tab accessing a website read data in a different browser tab which is accessing a different website? If I am using Gmail in one browser tab and then I subsequently create a new ...
6
votes
1answer
137 views

Information obtained from executing Javascript math functions in browser

I came across interesting piece of javascript across few sites. It's executing Javascript math functions such as abs, acos, random etc. thousands of times - or four thousand times in my case, though ...
1
vote
1answer
71 views

How do I use never remember history in Firefox effectively? [duplicate]

Under Firefox - Privacy and Security, I can change my history settings to never remember, remember, or use custom settings. Right now, I have it set to remember history, under what circumstances is ...
0
votes
0answers
20 views

Automatically notify about certificate changes in Firefox

I have the HTTPS Everywhere add-on for Firefox. I vaguely recall that several years ago either this or another add-on checked whether the CA for a certificate has changed. I'd like to be notified when ...
0
votes
0answers
35 views

Addons still work with Firefox on one account

I'm using Firefox 66.0.3 on Ubuntu, and like everyone else I'm experiencing the certificate bug which causes addons to be disabled. However, in one of my user accounts, the addons still work like a ...
0
votes
1answer
98 views

Unable to inject cookies

As part of an exercise, I need to sniff cookies from a login page and inject them in the same login page. If the cookie injection is successful the user must be login without entering the user name ...
0
votes
1answer
104 views

How can I inject cookie from Wireshark into a browser sesson [duplicate]

For education and research purpose, I need to inject a cookie value into my browser to allow me login indirectly (without entering the user name and password). I collected traffic during a login ...
1
vote
1answer
88 views

Can my open Firefox Sync session be used to circumvent a Master Password?

In short I'm wondering what's stopping someone with access to my computer account to exploit an open Firefox Sync session to view my synced passwords, even if a Master Password has been set. On this ...
-4
votes
1answer
69 views

How to configure proxy CA certificate in browser? [closed]

I was trying to download burp's CA certificate for Firefox on Kali from http://burp as specified in its documentation but the site is not available. It redirects me to http://www.inert.com/. So is ...
0
votes
2answers
73 views

Does HTTP:// to HTTPS:// redirection means strict HTTPS from server

when I try to connect to some websites using http:// (notice the absence of s) , my client end up with https://. I use python requests for this purpose, which simulate a client behavior. It performs ...
1
vote
1answer
73 views

How to defend myself against potential malicious browser add-ons?

So previously I asked a question about what type of private data can addons extract from my browser : Can a malicious add-on access internet history and such in Chrome/Firefox? and it turns out if ...
3
votes
1answer
95 views

When accepting an SSL certificate, can I limit for which domains I accept it?

Many organizations (e.g. companies, universities, ...) have internal sites and services for which they use SSL certificates issued by an internal CA, that isn't trusted by browsers or operating ...
18
votes
2answers
3k views

Can a malicious add-on access internet history and such in Chrome/Firefox?

How does Chrome/Firefox make sure add-ons are safe? Do they have any protection against a malicious add-on? How much access can add-ons have? Can they access internet history or maybe even cookies ...
9
votes
2answers
2k views

How to prevent Firefox and Chrome from opening ports in the firewall?

I have noticed that Firefox and Chrome have opened ports for unsolicited inbound traffic in the Windows firewall. This happened with Windows 7 x64 and Windows 10. (Here, I am talking about the ...
1
vote
1answer
188 views

Is it safe to use Orbot with the normal Firefox browser on Android

I noticed that when using Orbots "VPN Mode" that my normal Firefox browser works fine and when I visit check.torproject.org it says I'm connected even though I'm not using the Tor Browser specifically....
1
vote
0answers
51 views

Redirection to a blank page after searching on Google with the search bar of Firefox

Today I tried to use the search bar in the top-right side of Firefox (ver 65.0 64-bit on Linux Mint 18.3 Sylvia 64-bit), and the search bar contains "search Google in Traditional Chinese". When I use ...
0
votes
0answers
32 views

Are there any security implications to leaving Firefox's advanced developer tools enabled?

Mozilla's Firefox web browser has two advanced developer tools settings that are disabled by default. To enable them, open the Developer Tools settings, go to the section "Advanced Settings", and ...
0
votes
0answers
128 views

Am I safe after importing Bitdefender's fake certificate?

I installed Bitdefender today and suddenly I couln't navigate to numerous websites that I used to visit (I use Mozilla Firefox). I got the error: SEC_ERROR_UNKNOWN_ISSUER. I searched a bit and found ...
3
votes
0answers
95 views

HTML link with “noopener” and/or “noreferrer” in Chrome/Chromium results in unexpected behaviour

There are several attacks possible when embedding links with target="_blank". This is where rel="noopener" and rel="noreferrer" should help. I am expecting that clicking the following link <a ...
0
votes
1answer
29 views

Firefox switches charset encoding, brings up request to install extensin. Is this a “browser virus”?

I use Devuan ASCII (~= Debian Stretch) on my desktop, with Firefox and Chromium as my browsers. As I came back to my computer today after a few hours of non-use, and loaded a new browser frame, ...
1
vote
1answer
145 views

Do I understand SHA-1 brute-forcing speeds correctly? (Firefox Password Manager)

I read that the Firefox Password Manager has a "bug" (or rather poor design) in that it uses only a single sha-1 hash iteration for the password (which makes it extremely easy to brute-force ...
0
votes
1answer
46 views

Is it safe to browse the web through an SSH SOCKS5 connection to an untrusted proxy?

I have established an SSH tunnel to an untrusted machine: ssh -N -D 12345 john@example.com Next, I set up Firefox's connection settings to use the SSH tunnel by setting the SOCKS host to 127.0.0.1, ...
2
votes
1answer
255 views

Firefox warning: Content Security Policy: Couldn’t process unknown directive ‘require-sri-for’

Why does Firefox tell me Content Security Policy: Couldn’t process unknown directive ‘require-sri-for’ when Mozilla's documentation says they've implemented it? The meta tag Firefox is ...
2
votes
1answer
104 views

How can I block access to module for Firefox? (gmail accessing camera)

I run the following command in the background constantly to check for camera access on Ubuntu Linux: lsmod | grep ^uvcvideo I noticed that every time I load into gmail my check is triggering my ...
1
vote
1answer
136 views

Firefox is uploading lots of data during startup

Firefox is uploading lots of data during startup to servers like ec2-52-89-171-193.us-west-2.compute.amazonaws.com.https. Is there a way to find what data are being uploaded to any particular server ...
2
votes
1answer
97 views

I found a browser extension I don't trust installed, should I worry?

Someone told me that their Firefox had a strange new menu bar. I found that it was “FindYourMaps”. FindYourMaps is a deceptive browser toolbar that supposedly allows users to find driving ...
1
vote
1answer
136 views

How exposed am I using older Firefox version (56)?

Due to one add-on not being compatible with newer Firefox versions (57 and up), I'm stuck with Firefox 56 (running on Debian) for a while. I'm OK with things like performance or looks not being the ...
11
votes
1answer
968 views

Danger of browser extension without any permissions?

Assuming that an extension for Firefox or Chrome does not request any WebExtensions permission, what harm could this extension do? Or put another way: What (potentially malicious) actions can an ...
1
vote
0answers
299 views

Lowering Firefox sandbox settings to enable use of Sandboxie

As discussed on the official forum, to use Firefox 60+ with Sandboxie, Firefox's security.sandbox.content.level needs to be lowered to level 2. Now my concern is that the lowered sandbox content ...
2
votes
1answer
105 views

remove untrustworthy CAs from firefox

There are so many CAs in firefox, that are impossible to approve the reliability of all of them. How do I remove all CAs but the biggest ones like Lets Encrypt, Google Trust Services, GlobalSign and ...
3
votes
1answer
54 views

Firefox not deleting login data although being instructed to do so (possible security problem)

On one of my web servers, I have set up a password-protected directory using the well-known .htaccess / .htpasswd mechanism. The web server is run by Apache 2.4.10 under Debian jessie, if that matters....
1
vote
0answers
247 views

Why is Firefox trying to connect to an advertising company?

My firewall blocked Firefox from connecting to a site with an invalid security certificate. But why would it want to connect to an advertising site in the first place? Isn't Mozzilla and Firefox all ...
1
vote
1answer
32 views

What happens when a Firefox blocked extension is already installed and enabled/disabled?

Mozilla has been busy blocking Firefox extensions from their ecosystem due to security and privacy concerns. What happens when a blocked Firefox extension is already installed and enabled? What ...
1
vote
1answer
1k views

OWASP ZAP: How to use TLS client certificate authentication?

Is there a way to get OWASP ZAP to send a client certificate? I have an HTTPS website that receives client certificates for authentication. I have the certificates installed in the browser. ...
11
votes
2answers
2k views

Why do Chrome and Firefox report a different server certificate and issuer than OpenSSL?

When I visit https://somesite.org using Chrome or Firefox and inspect the server certificate, everything looks OK to me. I see SSL Server Certificate, CN, O, OU that appears to match somesite.org ...
0
votes
1answer
47 views

Can hackers access Firefoxs login storage through the internet?

Is it possible for hackers to access my Firefox browsers login storage through the internet? For instance if I visit a malicious website?
4
votes
1answer
991 views

Firefox Sync, end-to-end encryption

I'd like to sync my browsing data with multiple devices but I'm sure as hell I don't want to share my data with 3rd parties (whatever they claim). I've read in past that data saved via Firefox Sync ...
1
vote
1answer
159 views

somewhat complex dev domain https on local network cert problems

I was trying to mirror my setup to prod as much as possible so I only serve my dev site over https. The setup goes like this... I have a trusted CA on my machine made by devcert I generated some ...
3
votes
3answers
274 views

Has Firefox become bugless or where are the Firefox CVEs for 2017? [closed]

Through 2016 Firefox had about the same number (or same order of magnitude) of new issues listed as every other browser. Around 100-250. 2017 lists only a single issue https://www.cvedetails.com/...
1
vote
1answer
811 views

Webauthn configuration differences in Firefox

I'm trying to understand what the different configuration elements mean in Mozilla Firefox. There was an announcement recently from Dropbox that they had enabled support for WebAuthn. I tried logging ...
0
votes
1answer
106 views

Is Aria2 downloads detectable by web servers?

A couple of months ago I signed up for a paid online course. Their terms of service indicate that these video lectures are for streamed viewing and not to be downloaded. There's a 2 hour commute from ...
2
votes
1answer
390 views

Firefox sending Application Data in middle of SSL handshake

I am trying to write my own web server in Java 8, and i am running into a very odd problem. Whenever i make an SSL connection with Chrome, it works just fine. When i try with Firefox (59.0.2), i was ...
1
vote
1answer
142 views

Security on passwords stored by Firefox vs password manager

I am wondering about the safety of my passwords stored in FF > 57. I guess passwords stored in a Keepass database file are safe against cracking, as much as possible given its AES algorithm. Are ...
0
votes
1answer
85 views

Security on passwords stored by Firefox, against add-ons

I am wondering how safe are my passwords stored in the passwords manager built into Mozilla Firefox. Currently I am using Firefox Quantum 59.0.2 64-bit under Ubuntu 16.04 in one machine. I guess ...
3
votes
1answer
127 views

How to Send Decoded URI?

I'm working in Burp and received an interesting response when sending a decoded string as a GET request. Copying/pasting the same string into a browser, the string is automatically encoded by the ...
4
votes
1answer
197 views

Are browsers still vulnerable to IDN homograph attacks?

Is it not possible for Chrome and Firefox to protect against this > https://www.аррӏе.com/ Navigating to that above (fake) apple website using Firefox 59.0.2 doesn't actually take me to the apple ...