Hot answers tagged

97

SNI hole You've fallen into a "SNI hole". Google will present a different certificate if there is no "Server Name Indication" given in the client's TLS handshake part. OpenSSL will not set this automatically. You have to do it manually. But all modern web clients, including CURL, should do this automatically. Hence the difference. Using SNI with OpenSSL ...


76

There is a lot to unpack so I’ll do my best here (based on some assumptions). Firefox maintains its own certificate store which is likely the reason only Firefox is throwing these errors. Traditionally, SysAdmins will push out certificates through Group Policy, which works for both Chrome and IE / Edge but Firefox won’t trust it. I would imagine that your ...


69

To expand on what @d1str0 said: if the creator of your browser wanted to steal your passwords, it would be trivial to send them to a manufacturer controlled server whenever you entered them - they don't need to bother with the hassle of telling you about sync procedures, or offering to remember passwords. All browsers by default send a certain level of usage ...


54

Sounds like there is some confusion over the protections that different parts of your system provide. HSTS enforces HTTPS for users who have previously visited the site over HTTPS, for a given period. If a user has never visited the HTTPS version of a site, and the site is also available over HTTP (without a redirect to HTTPS), it will do nothing - the ...


53

Passwords saved by Firefox are not encrypted (they are encrypted but the key can be read out) until you set a master password. I don't think that this is a bug, but every virus could read those passwords nonetheless


50

I cannot answer the asked question, but I hope this could shed some light on your problem. Should corporate security rules forbid usage of some browser extension? IMHO the answer is YES here. Browser extensions can virtually do almost anything on behalf of the regular browser. That means that a local firewall will not detect them. Are there objective ...


47

If you were worried about Chrome or Firefox stealing your passwords, you wouldn't be using them as a web browser in the first place. An application like Keepass or LastPass can keep your passwords encrypted with a master password. If you don't use a master password, your web browser can unencrypt your passwords at any time. It's up to you on what level ...


41

You can prevent Ghostery from selling your data by opting out of the Ghost Rank feature. The feature is opt-in, so if you didn't already opt in there is nothing you need to do. It is then safe for you to use. Using a clone of Ghostery which is identical in every aspect except not having the Ghost Rank feature would make no practical difference from running ...


41

I suspect that Anders is right, and whoever set up the Chrome extension ban just didn't think about Firefox. If they realized that you were using Firefox to get around the ban, they'd probably forbid that too (or try to, anyway). FWIW, yes, browser extensions can be problematic from a security viewpoint, and I can see reasons for banning or heavily ...


33

You cannot assume that an add-on is safe "because it's hosted in one of the official extension galleries". In this answer, I start with the explanation of how extensions end up in the extension galleries for the popular browsers. At the end, I dedicate an extra section to Chrome. How does an item get listed in the official stores? Anyone with Google ...


33

Another plugin worth mentioning is Privacy Badger. It's fairly new, but from the EFF, to which I would trust not to do any bad stuff. It's also fairly intelligent since it's not using Blacklist which is always a race against tracker vendors, but uses an algorithm to determine what it should block. I'm using it and am pretty happy with it. The only downside ...


30

There are many scripts and projects to help site owners detect AdBlock Plus, but I think you're interested in how they work. The idea is simple. The website loads a JavaScript file called ads.js (or any other name that AdBlock Plus finds "attractive"), which contains: var amIHere = document.createElement("div"); amIHere.setAttribute("id", "amIHere"); ...


26

Modern browser extensions use the WebExtensions API, which enforces a permission model; basically, addons can only have the access that you grant them (you can't reject individual permissions though; if you are uncomfortable with some, you can't install the addon). Regarding your specific questions: The browser history can only be requested if the history ...


25

When the profile is initialized, a blank password (an empty string) is used. You can find the code for this in toolkit/components/passwordmgr/crypto-SDR.js on line 64: if (token.needsUserInit) { this.log("Initializing key3.db with default blank password."); token.initPassword(""); } Additionally, based on the import method in toolkit/components/...


23

I actually think the Mozilla devs have been pretty smart with this. Historically, most PDF exploits have come from the rendering engine rather than the parsing side. Adobe got wise early to the fact that malformed structure and content would screw them, and put a lot of effort into making sure that their parsing engine was rock solid. If you look at some of ...


22

No Firebug doesn't decrypt SSL traffic. Firebug just remind of one key detail: a SSL connection provides a protection against eavesdropping on the connection path. SSL should be seen as a crypted tunnel (VPN is another one), but on both ends of the tunnel, everything is in full light: in clear. Firebug isn't a vulnerability at all.


22

I agree with RobM. So it would be possible that they share everything they know about me with (american) governmental organizations. Yes, very possible. Are there even alternative browsers which wouldn't do this? The Onion Router. There may be others. Even Firefox will work this way if you use local syncing, and disable malware and phishing ...


21

Technically, the popup does not ask you whether you really want to download the file; that decision, you already took when you clicked on the link which triggered the download. The popup asks you what Firefox should do with the file when it has been fully downloaded. Potentially hostile files can be a security issue. Filesystems normally store files as ...


21

According to several forums, you can disable HSTS by introducing a new configuration variable. First, go to the Firefox configuration page (about:config), right-click, choose "New Integer", then provide the name "test.currentTimeOffsetSeconds" (no quotes) with a value of 11491200. This should bypass HSTS, although you may also need to clear the Cache and ...


21

Firefox can decrypt the passwords without you entering a password. That means it must have the decryption key--which means any program that knows how Firefox stores things can find them. This applies to any program that stores information on your system. Encryption is only a strong defense if you have to provide the decryption key before accessing the ...


19

Type about:support in firefox Click show in folder which should open your profile folder. Find file called SiteSecurityServiceState.txt and open it Find the entry for your site url and remove it. Entry would looks something like - github.com:HSTS 120 17242 1521194647604,1,1 Make sure for above firefox is closed so that it does not overwrite it. Firefox ...


17

On Firefox, you may want to try the Random Agent Spoofer addon. IMHO, this module is poorly named, probably for historical reasons, since the agent spoofing feature is completely optional and maybe not even the most interesting one. This module should be merely seen as an anti-tracking module, gathering both specific features and Firefox tracking-related ...


17

Unsure for your exact use case, but that is what the Server Name Indication TLS extension precisely addresses. In HTTPS, the SSL handshake where the server presents its certificate occurs before the server could examine any HTTP header. SNI allows the client to send the name of the virtual domain as part of the TLS negotiation.This enables the server to ...


16

Why do Firefox and Chrome allow such easy leaking of these session keys? To make it easier for developers to analyze their network captures. The first time I used this feature was when trying to understand what protocol is exactly used by the web-based noVNC. Using this functionality, I was able to decrypt the traffic in Wireshark. I read some ...


16

It's not really a cert, it's really more of an anti-cert, there to block DigiNotar even if some dumb user tries to click through the "Add Exception..." button. The evidence is that it says "Could not verify this certificate because it is not trusted". As pointed out by @JohnDeters, you can't revoke a self-signed root CA, so the only reason a root cert ...


15

Is this a problem with my browser? Firefox 39 and the Firefox 31 and 38 ESR releases upgrade the TLS implementation NSS to version 3.19.1. To harden the browser against Logjam attack the minimum key length for DH parameter within the TLS handshake is now 1023 bits. But the server at acs.onlinesbi.com only uses a DH key of 768 bits. This key length is ...


15

If no master password is set, Firefox uses an empty password. For a dirty Python script to decrypt and dump the data (plus some more), see the following code. It is an old project of mine and I just updated the reading of the passwords and usernames which were saved in signons.sqlite before (now in logins.json). I can't guarantee that (everything) is ...


14

If you have no master password set, then the login passwords are always available. If you do have a master password set, then opening the Saved Logins dialog will prompt you for the master password. Without the correct master password, the list of logins will be empty and thus there is no password to copy. The bug only occurs in this specific condition: A ...


Only top voted, non community-wiki answers of a minimum length are eligible