163 votes
Accepted

Why does my IT department block Firefox?

Assuming that you work in the bank industry, this is likely due to their inability to intercept Firefox's traffic. Due to Firefox's support of DoH and eSNI most banks and regulated industries are ...
mjoao's user avatar
  • 916
98 votes
Accepted

Why is there no certificate error while visiting google.net although it presents a certificate issued to google.com?

SNI hole You've fallen into a "SNI hole". Google will present a different certificate if there is no "Server Name Indication" given in the client's TLS handshake part. OpenSSL will not set this ...
StackzOfZtuff's user avatar
76 votes
Accepted

Why is Firefox (and only Firefox) reporting that my connection is insecure on multiple sites?

There is a lot to unpack so I’ll do my best here (based on some assumptions). Firefox maintains its own certificate store which is likely the reason only Firefox is throwing these errors. ...
DKNUCKLES's user avatar
  • 9,237
70 votes
Accepted

Should I allow browsers to remember my passwords and synchronize them?

To expand on what @d1str0 said: if the creator of your browser wanted to steal your passwords, it would be trivial to send them to a manufacturer controlled server whenever you entered them - they don'...
Matthew's user avatar
  • 27.3k
61 votes
Accepted

Can a browser extension (Chrome, Firefox, etc.) read the web console log?

Any extension that has access to the DOM can read whatever is written to the console by intercepting calls. The console is a JavaScript object; it is simple to proxy calls to console.log, like this ...
Fire Quacker's user avatar
  • 2,432
58 votes

Why does my IT department block Firefox?

TLDR - It might not be even about security. This could just be due to your company's preference. A friend of mine faced a similar issue. Firefox is blocked on his office laptop. When asked they simply ...
Kolappan N's user avatar
  • 2,692
53 votes

Avast AV could read Firefox saved passwords

Passwords saved by Firefox are not encrypted (they are encrypted but the key can be read out) until you set a master password. I don't think that this is a bug, but every virus could read those ...
RoiEX's user avatar
  • 561
52 votes
Accepted

How can you fake geolocation in Firefox?

Faking the Geolocation You can spoof the location provided via the HTML5 Geolocation API this way: Go to about:config. Type in geo.provider.network.url (or geo.wifi.uri in older versions) Change ...
Arminius's user avatar
  • 44.8k
50 votes
Accepted

Are there objective reasons to not allow Google Chrome extensions, but to allow Firefox extensions?

I cannot answer the asked question, but I hope this could shed some light on your problem. Should corporate security rules forbid usage of some browser extension? IMHO the answer is YES here. Browser ...
Serge Ballesta's user avatar
47 votes

Should I allow browsers to remember my passwords and synchronize them?

If you were worried about Chrome or Firefox stealing your passwords, you wouldn't be using them as a web browser in the first place. An application like Keepass or LastPass can keep your passwords ...
d1str0's user avatar
  • 2,348
43 votes

Can HSTS be disabled in Firefox?

Type about:support in firefox Click Profile Folder | Open Folder which should open your profile folder. Find file called SiteSecurityServiceState.txt and open it Find the entry for your site url and ...
Aniket Thakur's user avatar
42 votes

Are there objective reasons to not allow Google Chrome extensions, but to allow Firefox extensions?

I suspect that Anders is right, and whoever set up the Chrome extension ban just didn't think about Firefox. If they realized that you were using Firefox to get around the ban, they'd probably forbid ...
Ilmari Karonen's user avatar
29 votes

Can HSTS be disabled in Firefox?

I was able to disable it by setting network.stricttransportsecurity.preloadlist to false in about:config Then, to see the add exception button you may need to refresh the cache doing the 5 steps ...
Tobia's user avatar
  • 485
27 votes
Accepted

Can a malicious add-on access internet history and other sensitive info in Chrome/Firefox?

Modern browser extensions use the WebExtensions API, which enforces a permission model; basically, addons can only have the access that you grant them (you can't reject individual permissions though; ...
tim's user avatar
  • 29.6k
25 votes
Accepted

Why is DigiNotar CA still in my Mozilla Firefox?

It's not really a cert, it's really more of an anti-cert, there to block DigiNotar even if some dumb user tries to click through the "Add Exception..." button. The evidence is that it says "Could not ...
Mike Ounsworth's user avatar
24 votes

How trustworthy is Firefox?

I agree with RobM. So it would be possible that they share everything they know about me with (american) governmental organizations. Yes, very possible. Are there even alternative browsers ...
Mark Buffalo's user avatar
  • 22.6k
21 votes

Avast AV could read Firefox saved passwords

Firefox can decrypt the passwords without you entering a password. That means it must have the decryption key--which means any program that knows how Firefox stores things can find them. This ...
Loren Pechtel's user avatar
17 votes
Accepted

How can you change "system fonts" in Firefox (to increase own safety & privacy)?

On Firefox, you may want to try the Random Agent Spoofer addon. IMHO, this module is poorly named, probably for historical reasons, since the agent spoofing feature is completely optional and maybe ...
WhiteWinterWolf's user avatar
17 votes
Accepted

Why do Chrome and Firefox report a different server certificate and issuer than OpenSSL?

Unsure for your exact use case, but that is what the Server Name Indication TLS extension precisely addresses. In HTTPS, the SSL handshake where the server presents its certificate occurs before the ...
Serge Ballesta's user avatar
17 votes

What would happen if some random webpage made an Ajax request for http://127.0.0.1/private.txt?

Reading Cross-Origin Resource Sharing CORS and the Same Origin Policy SOP are your friends here. Since the javascript in question is not hosted by http://127.0.0.1, it will run afoul of the SOP and ...
Conor Mancone's user avatar
16 votes
Accepted

Firefox bug permits stealing encrypted passwords: How is this possible?

If you have no master password set, then the login passwords are always available. If you do have a master password set, then opening the Saved Logins dialog will prompt you for the master password. ...
Lekensteyn's user avatar
  • 6,088
13 votes
Accepted

How does sending referrer HTTP headers protect against CSRF attacks?

To understand this, one first needs to understand what a cross-site request forgery is. A Cross-Site Request Forgery is when the attacker has some script or embedded media on a website they control ...
Philipp's user avatar
  • 49.4k
13 votes
Accepted

Why are HTTPS requests blocked by Firefox when using ZAP proxy?

ZAP creates certificates, on the fly, in the name of the site Firefox is going to. Firefox is saying "I don't trust the CA that signed this cert", which is reasonable, because it's a MITM by an ...
gowenfawr's user avatar
  • 72.9k
13 votes

Why is Firefox (and only Firefox) reporting that my connection is insecure on multiple sites?

Why is Firefox the only browser reporting these security errors? As already said, Firefox use its own Certificate Authority store, managing it from a company point of view is hard and usually not ...
Tensibai's user avatar
  • 528
12 votes

How trustworthy is Firefox?

How trustworthy? Good enough for most purposes, and better than using the same password everywhere. Your data is encrypted Your Firefox Sync data is encrypted, and the encryption key remains on ...
paj28's user avatar
  • 33.4k
12 votes

Why does my IT department block Firefox?

Most likely IT didn't want to be responsible for centralized updates. Without concerted updates individual installations fall out of date and vulnerabilities, once found, may remain unpatched. So ...
gowenfawr's user avatar
  • 72.9k
12 votes
Accepted

How did Firefox get my passwords?

(I had to make some quick research for this intriguing question). The saved passwords can be decrypted by Firefox (or any other software) as long as it is running within your windows account on the ...
elsadek's user avatar
  • 1,862
11 votes
Accepted

Avast AV could read Firefox saved passwords

How does Firefox save the passwords? Previous answers have already presented the general idea, but a more in-depth explanation can be provided. Firefox stores all user information in the profile ...
Marc.2377's user avatar
  • 594
11 votes

Does Mozilla's new "Facebook Container" have any advantages over uBlock Origin?

To understand the differences, we have to look at the different goals of the two. Or in other words: What do they want to do? What do they do? And how does it affect you as an end user? In this answer ...
Tom K.'s user avatar
  • 7,976

Only top scored, non community-wiki answers of a minimum length are eligible