Basic firefox security tips

Pollmaster · May 6, 2005

You guys probably know all the tips given here already, but still..

Browsing untrusted sites

While Firefox does not allow web sites to install software without your permission, it does not fully protect you from some other things. This section describes some extra precautions you should take on sites that you do not trust at all. (Most of these precautions apply to all web browsers, but we still wish you didn't have to know all this to stay secure. We're working on it.)

When sites open new windows, they can hide the address bar. If you are viewing an untrusted site and a new window appears that seems to be your bank, be wary, because the address bar in that window might be fake or "spoofed" (XUL example, HTML example). There are several things you can do to protect yourself against spoofed address bars:

* Use a browser option to open web-page-opened windows in tabs instead of windows. Firefox does not yet have this option (bug 227241), but there are Firefox extensions that add it.
Click to expand...

Note: Firefox has this option now, without extensions.

* There are "hidden" preferences that let you prevent web pages from hiding toolbars and other user interface elements. Load about:config and change preferences beginning with "dom.disable_window_open_feature." to true.
* Glance at your bookmarks toolbar (which should be below the address bar) before looking at the address bar. An attacker won't be able to spoof your bookmarks toolbar unless he can guess what items are on your bookmarks toolbar and in what order.
* [Once bug 252811 is fixed...] Look at the hostname in the status bar instead of in the address bar. The status bar cannot be spoofed because web sites cannot hide it when they create new windows. Unfortunately, the hostname is only shown in the status for https sites.

When you add a bookmark, you should be aware of whether it is a data:, javascript:, or vbscript: URL. If it is one of those types of URLs, clicking the bookmark allows scripts contained in the bookmark to run in the context of the site you're viewing. The script could steal cookies, stored passwords, or act on your behalf on that site (bug 28387). Bookmarks using the javascript: protocol are called bookmarklets and are often useful, which is why Firefox does not warn you when bookmark such a URL.

Since a site can display anything in its content area, it can display something that looks like another browser window. For example, a site in a maximized window might make a small "browser window" appear inside itself that looks like Paypal. One way to be safe is to maximize sites before typing passwords or personal information; you won't be able to maximize the fake window because it isn't really a window.

After saving or downloading files, make sure they are data files rather than programs. See the section below, Downloading files and e-mail attachments, for how to tell them apart.

Don't save and open untrusted HTML files. While HTML files are safe to view over the Web, they are no longer safe once you save them. Opening an HTML file from your hard drive allows JavaScript in the HTML file to read any text or HTML document on your hard drive (bug 230606 and bug 209234).

If you're new to typing or learning a new keyboard layout, keep an eye on the screen while you type so you don't inadvertantly press a key that accepts a software installation dialog. (Related to bug 162020.)

You can use the status bar to see where links go, for example to avoid clicking links to http://goatse.cx/. But sites can use JavaScript to make it so the text displayed in the status bar is not the same as the link URL -- even if you uncheck "Allow sites to... change status bar text". The status bar is reliable when you are reading forums such as Slashdot, where you trust the site but not the person posting the link, and it is realiable while reading e-mail (assuming you haven't enabled JavaScript for mail message). But the status is not reliable when you are viewing a site where the person who included the link can also include JavaScript.

If you type a lot of text into a web site, the site could cause your browser to upload a file with a known path and name (bug 56236).

If you copy text from a web site and paste it back into that web site, the site could cause your browser to upload a file with a known name (bug 57770). Most non-Mac web browsers are vulnerable.

If you copy text from a web site and paste it back into that web site, the site could read what was in your clipboard before by preventing the copy command from working.

Do not paste text from untrusted web pages into IRC programs or DOS command prompts. A site can disguise text so that it looks like you're copying one thing when you're copying another. The text you paste may contain line breaks, causing the program to execute commands in the pasted text and giving the attacker control over your computer. One solution is to open a Notepad window, paste, check that the text is what you expect, select all, cut, and close Notepad.

Web sites can find out whether you have visited a given URL unless you disable global history (bug 147777).
Browsing from a public computer
Click to expand...

http://www.squarefree.com/securitytips/users.html - Much more available.

FFox ex-user · May 8, 2005

HiThanks for this tip.
Cheers

squash · May 9, 2005

Thanks alot, very helpful info.

Log in or Sign up

Basic firefox security tips

Pollmaster Guest

FFox ex-user Guest

squash Registered Member

Log in or Sign up

Basic firefox security tips

Pollmaster Guest

FFox ex-user Guest

squash Registered Member

Useful Searches