3 ms·
The same MitM update attack can be leveled against all Firefox users, and not just Tor browser users?
by willvarfar 10y ago
The same MitM update attack can be leveled against all Firefox users, and not just Tor browser users?
- MBCook 10y agoIt doesn't like like it: 1. You'd need to be able to MitM all of them (where controlling a ton of TOR exit nodes comes in handy) 2. You'd need to know an extension lots of people have (I'm guessing NoScript is default on TOR browsers)
- necessity 10y agoYes, but being the man in the middle is much easier when the target willingly places you in the middle of his connection... The whole situation can be worked around by using a custom prefs.js that disables auto updating addons (there are various other attacks that can be prevented by tweaking settings in about:config such as the webrtc related ones) and there are various websites providing privacy oriented prefs.js. A better workaround would be for the TOR browser maintainers to ship such a file with it, and a solution would of course be Mozilla fix things on their side.