164
votes
Accepted
Why does my IT department block Firefox?
Assuming that you work in the bank industry, this is likely due to their inability to intercept Firefox's traffic.
Due to Firefox's support of DoH and eSNI most banks and regulated industries are ...
- 926
98
votes
Accepted
Why is there no certificate error while visiting google.net although it presents a certificate issued to google.com?
SNI hole
You've fallen into a "SNI hole". Google will present a different certificate if there is no "Server Name Indication" given in the client's TLS handshake part. OpenSSL will not set this ...
- 18.2k
75
votes
Accepted
Why is Firefox (and only Firefox) reporting that my connection is insecure on multiple sites?
There is a lot to unpack so I’ll do my best here (based on some assumptions).
Firefox maintains its own certificate store which is likely the reason only Firefox is throwing these errors. ...
- 9,217
61
votes
Accepted
Can a browser extension (Chrome, Firefox, etc.) read the web console log?
Any extension that has access to the DOM can read whatever is written to the console by intercepting calls. The console is a JavaScript object; it is simple to proxy calls to console.log, like this ...
- 2,430
59
votes
Why does my IT department block Firefox?
TLDR - It might not be even about security. This could just be due to your company's preference.
A friend of mine faced a similar issue. Firefox is blocked on his office laptop. When asked they simply ...
- 2,702
52
votes
Accepted
How can you fake geolocation in Firefox?
Faking the Geolocation
You can spoof the location provided via the HTML5 Geolocation API this way:
Go to about:config.
Type in geo.provider.network.url (or geo.wifi.uri in older versions)
Change ...
- 45k
50
votes
Accepted
Are there objective reasons to not allow Google Chrome extensions, but to allow Firefox extensions?
I cannot answer the asked question, but I hope this could shed some light on your problem.
Should corporate security rules forbid usage of some browser extension?
IMHO the answer is YES here. Browser ...
- 26.8k
44
votes
Can HSTS be disabled in Firefox?
Type about:support in firefox
Click Profile Folder | Open Folder which should open your profile folder.
Find file called SiteSecurityServiceState.txt and open it
Find the entry for your site url and ...
- 1,095
42
votes
Are there objective reasons to not allow Google Chrome extensions, but to allow Firefox extensions?
I suspect that Anders is right, and whoever set up the Chrome extension ban just didn't think about Firefox. If they realized that you were using Firefox to get around the ban, they'd probably forbid ...
- 4,486
30
votes
Can HSTS be disabled in Firefox?
I was able to disable it by setting network.stricttransportsecurity.preloadlist to false in about:config
Then, to see the add exception button you may need to refresh the cache doing the 5 steps ...
- 495
27
votes
Accepted
Can a malicious add-on access internet history and other sensitive info in Chrome/Firefox?
Modern browser extensions use the WebExtensions API, which enforces a permission model; basically, addons can only have the access that you grant them (you can't reject individual permissions though; ...
- 29.7k
26
votes
Accepted
Why is DigiNotar CA still in my Mozilla Firefox?
It's not really a cert, it's really more of an anti-cert, there to block DigiNotar even if some dumb user tries to click through the "Add Exception..." button.
The evidence is that it says "Could not ...
- 59.2k
17
votes
Accepted
How can you change "system fonts" in Firefox (to increase own safety & privacy)?
On Firefox, you may want to try the Random Agent Spoofer addon.
IMHO, this module is poorly named, probably for historical reasons, since the agent spoofing feature is completely optional and maybe ...
- 19.3k
17
votes
Accepted
Why do Chrome and Firefox report a different server certificate and issuer than OpenSSL?
Unsure for your exact use case, but that is what the Server Name Indication TLS extension precisely addresses.
In HTTPS, the SSL handshake where the server presents its certificate occurs before the ...
- 26.8k
17
votes
Accepted
Firefox bug permits stealing encrypted passwords: How is this possible?
If you have no master password set, then the login passwords are always available. If you do have a master password set, then opening the Saved Logins dialog will prompt you for the master password. ...
- 6,088
17
votes
What would happen if some random webpage made an Ajax request for http://127.0.0.1/private.txt?
Reading
Cross-Origin Resource Sharing CORS and the Same Origin Policy SOP are your friends here. Since the javascript in question is not hosted by http://127.0.0.1, it will run afoul of the SOP and ...
- 31.5k
13
votes
Accepted
How does sending referrer HTTP headers protect against CSRF attacks?
To understand this, one first needs to understand what a cross-site request forgery is.
A Cross-Site Request Forgery is when the attacker has some script or embedded media on a website they control ...
- 49.5k
13
votes
Accepted
Why are HTTPS requests blocked by Firefox when using ZAP proxy?
ZAP creates certificates, on the fly, in the name of the site Firefox is going to.
Firefox is saying "I don't trust the CA that signed this cert", which is reasonable, because it's a MITM by an ...
- 73.1k
13
votes
Why is Firefox (and only Firefox) reporting that my connection is insecure on multiple sites?
Why is Firefox the only browser reporting these security errors?
As already said, Firefox use its own Certificate Authority store, managing it from a company point of view is hard and usually not ...
- 528
13
votes
Why does my IT department block Firefox?
Most likely IT didn't want to be responsible for centralized updates.
Without concerted updates individual installations fall out of date and vulnerabilities, once found, may remain unpatched. So ...
- 73.1k
12
votes
Accepted
How did Firefox get my passwords?
(I had to make some quick research for this intriguing question).
The saved passwords can be decrypted by Firefox (or any other software) as long as it is running within your windows account on the ...
- 1,862
10
votes
Accepted
HTTP not being converted to HTTPS with HSTS
To cite from the source code you mention:
354 // Other Google-related domains that must use an acceptable certificate
355 // iff using SSL.
...
361 { "name": "doubleclick.net", "...
- 205k
10
votes
How does Firefox's "first-party isolation" feature function?
From a cursory look, they isolate the cookies (and other data) on silos based on the domain you navigated to.
So eg. a load to facebook.com when visiting www.stackexchange.com, would put facebook ...
- 19k
10
votes
Does Mozilla's new "Facebook Container" have any advantages over uBlock Origin?
To understand the differences, we have to look at the different goals of the two.
Or in other words: What do they want to do? What do they do? And how does it affect you as an end user?
In this answer ...
- 8,001
10
votes
Accepted
Effect of Firefox's "Responsive Design Mode" on the browser's fingerprint
There is no single fingerprinting method. But assuming that the fingerprinting you fear tries to be as granular as possible it will not only include easily fakeable things like User-Agent header but ...
- 205k
9
votes
How safe are Firefox addons from official mozilla.org site?
The accepted answer is out of date.
As of October 28, 2017 Firefox FAQ states a different view (note the "may"):
Are add-ons safe to install?
Use caution when installing add-ons, as they ...
- 191
9
votes
Accepted
What is the impact of "urgent Firefox update" malware?
If it is a brand new laptop I would just reinstall the OS.
The malware that you executed will not be fixed by removing Firefox. If your computer had more time invested in it, it may of been worth ...
- 2,811
9
votes
How can I set a lower trust level for Let's Encrypt in Firefox?
As Matthew says, the difference isn't between Let's Encrypt and other CAs, it is between Domain Validated (DV) and Extended Validation (EV) certificates. That's what you want to distinguish, since ...
- 6,381
9
votes
Are there objective reasons to not allow Google Chrome extensions, but to allow Firefox extensions?
Yes.
There can be a legitimate reason:
Chrome extensions are always automatically updated.
Firefox extensions are not required to be auto-updated.
This means that if the account of the developer ...
- 2,582
9
votes
Firefox Sync, end-to-end encryption
There's a really good explanation of the crypto/auth for FxA. Looking at it, it shows that both the authentication key and the private data wrapping key are independently derived from the password in ...
- 16.1k
Only top scored, non community-wiki answers of a minimum length are eligible