23 ms·

Feeling safer online with Firefox

378 points by nachtigall 10y ago

akjainaj 10y ago
The only thing that would make me feel safer would be the sandbox.
- hackermailman 10y ago
  Mbox exists for this or FireJail, Sandboxie (Windows)or OSX sandbox-exec https://pdos.csail.mit.edu/archive/mbox/ https://pdos.csail.mit.edu/archive/mbox/ https://wiki.mozilla.org/Security/Sandbox https://wiki.mozilla.org/Security/Sandbox
  - sha666sum 10y ago
    Sandboxie is nonfree and after a trial period only allows sandboxing one app at once. Firejail just had a local privilege escalation exploit, but I'm still using it (although more cautiously than before). Mbox appears unmaintained, and sandbox-exec isn't even for a platform I use. I'm quite glad that Firefox implements sandboxing of its own.
    - hackermailman 10y ago
      Look at the sandbox used for SubgraphOS (Debian/Jessie only) https://github.com/subgraph/oz https://github.com/subgraph/oz
      - geofft 10y ago
        The goal of browser sandboxing is to protect different sites from each other. It does me no good if some malicious ad uses some plugin bug or JavaScript heap spray or something, and my sandbox successfully prevents the exploit from escaping the browser, but the same browser also has my bank open in another tab. Given that 95% of what I do on my personal computer is in the browser, sandboxing the rest of my computer from the browser is sort of a https://xkcd.com/1200/ https://xkcd.com/1200/ situation.
- gcp 10y ago
  The Windows version of Firefox is already sandboxed. (The other platforms are too, but not in release)
thinkMOAR 10y ago
As long as more and more features get added the more the attack surface increases on firefox and all other browsers. Feeling safe, and being safe are two different things. Same goes for self signed (or expired) certificates and 'not secure' connections, they are not per definition 'not secure'.
- pawadu 10y ago
  Could not agree more (see my other comment). Firefox should slim down to reduce the attack surface.
  - Analemma_ 10y ago
    Reduced attack surface or standards compliance; pick one.
- mido22 10y ago
  not sure if you can call these features, these are basically options to see what permissions you have given and what are being used by whom, and as for the features question, any day I would prefer camera access through WebRTC than installing and using flash plug-in.
pawadu 10y ago
I am sure there are people who would love a browser that can control their car or pacemaker and report their bank balance on the welcome page. But I personally would feel far more secure if there was a firefox-lite where no sensitive stuff (access camera, share screen) were included to start with. And I don't mean turned off by default, I want it removed at compile time.
- mido22 10y ago
  I disagree, I trust WebRTC enough for camera and screen access, the one real issue might be, it exposes your local ip
  - Noseshine 10y ago
    It seems uBlock Origin has a setting (right on the main settings page) that can prevent the local IP to be leaked: https://github.com/gorhill/uBlock/wiki/Prevent-WebRTC-from-leaking-local-IP-address https://github.com/gorhill/uBlock/wiki/Prevent-WebRTC-from-l... You can test it here: https://browserleaks.com/webrtc https://browserleaks.com/webrtc I tried that test page with the mentioned setting 1) enabled and 2) disabled. I did not see my local IP on 1), I did get see it reported with 2) - so it seems the block works. NOTE: Whether uBlock Origin was enabled for the specific page did not matter, the WebRTC block setting seems to be global and independent of whether the extension blocks anything else on the site.
- sp332 10y ago
  As mido22 said, the alternative right now is a closed plugin (Flash) or installing software on your computer completely outside of the sandbox. Putting these features in the browser in a controllable way is a step forward. If you don't need them, Firefox is open source and I'm not just saying that to be glib. You can easily grab the source https://developer.mozilla.org/en-US/docs/Mozilla/Developer_guide/Build_Instructions https://developer.mozilla.org/en-US/docs/Mozilla/Developer_g... and compile it with --disable-webrtc https://developer.mozilla.org/en-US/docs/Mozilla/Developer_guide/Build_Instructions/Configuring_Build_Options https://developer.mozilla.org/en-US/docs/Mozilla/Developer_g...
therealmarv 10y ago
Firefox is not even looked at pwn2own competition because it's too easy to hack and not using good OS or sandbox protection https://it.slashdot.org/story/16/02/12/034206/pwn2own-2016-wont-attack-firefox-because-its-too-easy https://it.slashdot.org/story/16/02/12/034206/pwn2own-2016-w...
- noja 10y ago
  But the Safari browser is? And Tor Browser uses Firefox?
- Santosh83 10y ago
  How do you know with such certainty that it is because it is too easy to hack and not because Chrome is the current "big fish" among browsers and Google gives monetary rewards to white hats, both of which could reasonably fuel disproportionate interest in breaking Chrome?
  - AdmiralAsshat 10y ago
    Reasons aside, the fact remains that when a group of white-hat hackers says they "won't bother" with a given target, it doesn't speak well to that target's security. There are no-doubt tons of exploits in Firefox still waiting to be found, as there are in Chrome, Opera, Edge, etc. Given that the Tor Browser is built on top of Firefox, it's a huge loss for everyone that Firefox is not being included in the attacks; the vulnerabilities that the white-hats find would be reported and promptly plugged, rather than left open for nefarious three-letter agencies to exploit.
    - noja 10y ago
      > Reasons aside No. Reasons not aside. Reasons are very important.
      - AdmiralAsshat 10y ago
        If we don't know what the reason was, and they won't elaborate on it, what importance does it have? Pwn2Own 2016 already happened. Firefox wasn't included, for whatever reason. The damage is already done at this point, as its exclusion created the impression that it was "not worth attacking". If the guys had said, "We didn't bother with Firefox because they weren't willing to pay us as much as Google or Microsoft", okay. But they didn't. What they said was: 'We wanted to focus on the browsers that have made serious security improvements in the last year,' Brian Gorenc, manager of Vulnerability Research at HPE said." And now Firefox looks weak by comparison.
coldpie 10y ago
The incorrect system time detection is a small feature, but actually pretty neat. I've run into that before, when testing time-sensitive features in my software and forgetting to change it back, then wondering why on Earth nothing secure works anymore.
- chrisper 10y ago
  Any reason why you would not try time-sensitive stuff in a VM?
  - coldpie 10y ago
    Easier to change the system clock than set up a VM :P Especially for macOS.
- BuuQu9hu 10y ago
  Anyone know how it detects the system time is wrong?
mard 10y ago
It's a step in right direction, but would certainly feel safer if in addition to cookies/storage/geolocation permissions, Firefox allowed to whitelist JavaScript on certain domains out of box, with no need to resort to NoScript. Using NoScript results in two different whitelist mechanisms with completely different UI which breaks the browsing experience. Ironically, as far as "privacy-oriented browsers" go, Chrome has domain whitelisting of Cookies/JS/Plugins easily accessible from address bar and it works as expected.
agumonkey 10y ago
Nice post, it's hard to realize progress made in secondary UI elements such as security panels.
w8rbt 10y ago
I run FireFox on Linux for personal on-line banking. It's the only browser that I am able to run with Tomoyo Linux in enforcing mode (level 3). I'm sure, if given enough time, I could build a Tomoyo policy for Chrome, but it's far more verbose than FireFox and the last few times I tried, I gave up.
- hackuser 10y ago
  If you don't mind answering: How usable is Tomoyo for you overall? How much extra time does it consume? Are there things that just don't run? Are there many bugs in applications that do run? (Also, which distro are you using?) Thanks!
  - w8rbt 10y ago
    Debian 8. I find Tomoyo to be the most usable of the LSMs. You can be up and running in a few days with rather complex policies. I could not get Chrome to work with it. It just reads and writes all over the place in ways that are hard to manage. No bugs yet.
drdaeman 10y ago
Am I only the one who finds "new" (well, it was there for about an year, I believe) "Site Identity and Permissions Panel" panel to be literally useless for the "site identity" part? It has no information on CA, whenever it's first time you saw this exact certificate or not, whenever a "weak" or "strong" ciphers are used (and if PFS is enabled), etc - things one'd really want to see if they care about their connection encryption and authentication. It's all still available, but hidden after long sequence of button clicks. Heck, it would be useful to have client certificate and HTTP auth status there as well - it would actually make those nice things closer to being usable. I really fail to understand why it can't be displayed in a sanely concise manner - and why things that were there before were removed. Surely there's a plenty of screen space and it's not like it would scare Joe Sixpack off to Chrome, or confuse anyone. Or analytics show it otherwise?
- leeoniya 10y ago
  i'm also not a fan of all the ui reduction and "simplification" just for the sake of a refresh. needless to say the only reason i'm still able to use firefox is Classic Theme Restorer. Once that is unable to run, i'll be off to Opera or Ungoogled Chromium or maybe Servo (hopefully we get a few years for "power" users before that gets gutted too)
- past 10y ago
  There have been a number of user studies done by Mozilla and other browser vendors that clearly show end users only have a basic grasp of the security properties of the web. So yes, more details in main UI elements leads to confusion. It's just 2 clicks for those of us who know what a certificate is (Ctrl/Cmd-I is even faster).
  - drdaeman 10y ago
    > It's just 2 clicks Three, actually. One on the i+lock icon pair, one on the right-pointing arrow, then one on "more info". If I'd need more details (like issue and expiry dates, which is pretty common thing to be interested in), then it's 1 more button "view certificate". And if I'd happen to be interested in certificate public key properties (algorithm and key size) it's a really long story, 6 clicks away from the address bar. It certainly makes sense to not show something right away, on the first click. But the current UI hides quite essential information (to those who can understand it) way too deep. I'm really not persuaded it would hurt usability and confuse users if such information would be 2 clicks away, rather than 4-6. (And, really, it mustn't hurt to show at least "have I visited this page prior to today? yep, 234 times" on the very first click. And probably won't confuse anyone much to also see something like "TLS1.2, modern ciphers" or "TLS1.0, legacy ciphers".) > Ctrl/Cmd-I Toggles bookmarks sidebar for me. I'm unaware of any shortcut to open page info.
sgustard 10y ago
The status "Use the Camera - Allow - X" can be confusing. Is the site currently allowed to use the camera, or not? The word Allow could either mean "currently allowed" or "click to allow." The X could mean either "currently blocked" or "click to block."
- spacehunt 10y ago
  The X has a tooltip that says "Clear this permission and ask again" so it's quite clear to me.
  - azdle 10y ago
    Right, but it would be much more clear, without needing to read the tooltip, if it just said "Allowed - X", which IMHO is pretty clear that it is currently allowed and can be revoked with the 'X'.
    - MichaelGG 10y ago
      Agree - this was the first thought I had and came here to comment on it. When using the UI it's a bit more clear: you can't click "Allow". But just looking at the screenshot, I had the impression this was a request dialog somehow. I thought Allow was clickable to give permission, and the X was to dismiss being told the site wanted to know about the permission request. The little X doesn't seem like a common UI element to indicate "block", but it's probably ugly to say "Allowed - [Block]". Another idea might be to write "Currently allowed" or "This site has access to" under the word "Permissions".
- dao- 10y ago
  Filed https://bugzilla.mozilla.org/show_bug.cgi?id=1331172 https://bugzilla.mozilla.org/show_bug.cgi?id=1331172
mossby 10y ago
Did Firefox unbloat yet?
nfriedly 10y ago
> In the new design, permission prompts stay up even when you interact with the page. I think this is going to be a nice improvement. It was way to easy to "loose" the permissions dialog in the older flow.
bhauer 10y ago
Awesome changes. One suggestion: In the Control Center™, I would recommend using the past-tense for the current state. E.g., Receive Notifications Allowed X Access Your Location Allowed X Maintain Offline Storage Allowed X As it exists in the screenshots, the present tense is used, and the X button seems to be associated with the word "Allow." Further clarification could be achieved by making the X button actually say "Disallow" and giving it a border separate from the word "Allowed." E.g., Receive Notifications Allowed [Disallow]
- toggle 10y ago
  > Further clarification could be achieved by making the X button actually say "Disallow" and giving it a border separate from the word "Allowed." I agree. An X usually means "close" or "hide this thing," whereas here they're using it to change a setting. It really looks like there should be a toggle switch there.
  - past 10y ago
    This is exactly right that X means "close" or "hide this thing" and this is what it does in this case as well: it removes the non-default setting and hides the list item.
- dao- 10y ago
  Filed https://bugzilla.mozilla.org/show_bug.cgi?id=1331172 https://bugzilla.mozilla.org/show_bug.cgi?id=1331172
- past 10y ago
  Thanks for the suggestion, this has now been fixed.
Auzy 10y ago
I love firefox.. My big problem as a late though seems to be that sites stop loading intermittently, need to be refreshed or I need to wait (and I don't have this problem on Chrome). Also, I got kind of annoyed when one of their leaders came begging for donations by email, but are getting paid FAR beyond normal wage.
Dylan16807 10y ago
Making it easy to see permissions for the current site is great, but why is there no way to see all the sites that have special permissions? Firefox used to have about:permissions but that was removed last year.
- past 10y ago
  about:permissions was an incomplete experimental UI, but a fully functional replacement is high on our priority list. We are waiting on a new design from the UX team at the moment.
khana 10y ago
I'm excited to see FF undertake security this way. It's the right thing to do.
Hydraulix989 10y ago
Extensions still run in Private Tabs, unlike with Chrome, so they are free to phone home about your private browsing as much as they'd like. This is the real privacy hole that still needs to be fixed.

378 points by nachtigall 10y ago

akjainaj 10y ago

The only thing that would make me feel safer would be the sandbox.

hackermailman 10y ago
Mbox exists for this or FireJail, Sandboxie (Windows)or OSX sandbox-exec https://pdos.csail.mit.edu/archive/mbox/ https://pdos.csail.mit.edu/archive/mbox/ https://wiki.mozilla.org/Security/Sandbox https://wiki.mozilla.org/Security/Sandbox
- sha666sum 10y ago
  Sandboxie is nonfree and after a trial period only allows sandboxing one app at once. Firejail just had a local privilege escalation exploit, but I'm still using it (although more cautiously than before). Mbox appears unmaintained, and sandbox-exec isn't even for a platform I use. I'm quite glad that Firefox implements sandboxing of its own.
  - hackermailman 10y ago
    Look at the sandbox used for SubgraphOS (Debian/Jessie only) https://github.com/subgraph/oz https://github.com/subgraph/oz
    - geofft 10y ago
      The goal of browser sandboxing is to protect different sites from each other. It does me no good if some malicious ad uses some plugin bug or JavaScript heap spray or something, and my sandbox successfully prevents the exploit from escaping the browser, but the same browser also has my bank open in another tab. Given that 95% of what I do on my personal computer is in the browser, sandboxing the rest of my computer from the browser is sort of a https://xkcd.com/1200/ https://xkcd.com/1200/ situation.
gcp 10y ago
The Windows version of Firefox is already sandboxed. (The other platforms are too, but not in release)

thinkMOAR 10y ago

As long as more and more features get added the more the attack surface increases on firefox and all other browsers. Feeling safe, and being safe are two different things. Same goes for self signed (or expired) certificates and 'not secure' connections, they are not per definition 'not secure'.

pawadu 10y ago
Could not agree more (see my other comment). Firefox should slim down to reduce the attack surface.
- Analemma_ 10y ago
  Reduced attack surface or standards compliance; pick one.
mido22 10y ago
not sure if you can call these features, these are basically options to see what permissions you have given and what are being used by whom, and as for the features question, any day I would prefer camera access through WebRTC than installing and using flash plug-in.

pawadu 10y ago

I am sure there are people who would love a browser that can control their car or pacemaker and report their bank balance on the welcome page. But I personally would feel far more secure if there was a firefox-lite where no sensitive stuff (access camera, share screen) were included to start with. And I don't mean turned off by default, I want it removed at compile time.

mido22 10y ago
I disagree, I trust WebRTC enough for camera and screen access, the one real issue might be, it exposes your local ip
- Noseshine 10y ago
  It seems uBlock Origin has a setting (right on the main settings page) that can prevent the local IP to be leaked: https://github.com/gorhill/uBlock/wiki/Prevent-WebRTC-from-leaking-local-IP-address https://github.com/gorhill/uBlock/wiki/Prevent-WebRTC-from-l... You can test it here: https://browserleaks.com/webrtc https://browserleaks.com/webrtc I tried that test page with the mentioned setting 1) enabled and 2) disabled. I did not see my local IP on 1), I did get see it reported with 2) - so it seems the block works. NOTE: Whether uBlock Origin was enabled for the specific page did not matter, the WebRTC block setting seems to be global and independent of whether the extension blocks anything else on the site.
sp332 10y ago
As mido22 said, the alternative right now is a closed plugin (Flash) or installing software on your computer completely outside of the sandbox. Putting these features in the browser in a controllable way is a step forward. If you don't need them, Firefox is open source and I'm not just saying that to be glib. You can easily grab the source https://developer.mozilla.org/en-US/docs/Mozilla/Developer_guide/Build_Instructions https://developer.mozilla.org/en-US/docs/Mozilla/Developer_g... and compile it with --disable-webrtc https://developer.mozilla.org/en-US/docs/Mozilla/Developer_guide/Build_Instructions/Configuring_Build_Options https://developer.mozilla.org/en-US/docs/Mozilla/Developer_g...

therealmarv 10y ago

Firefox is not even looked at pwn2own competition because it's too easy to hack and not using good OS or sandbox protection https://it.slashdot.org/story/16/02/12/034206/pwn2own-2016-wont-attack-firefox-because-its-too-easy https://it.slashdot.org/story/16/02/12/034206/pwn2own-2016-w...

noja 10y ago
But the Safari browser is? And Tor Browser uses Firefox?
Santosh83 10y ago
How do you know with such certainty that it is because it is too easy to hack and not because Chrome is the current "big fish" among browsers and Google gives monetary rewards to white hats, both of which could reasonably fuel disproportionate interest in breaking Chrome?
- AdmiralAsshat 10y ago
  Reasons aside, the fact remains that when a group of white-hat hackers says they "won't bother" with a given target, it doesn't speak well to that target's security. There are no-doubt tons of exploits in Firefox still waiting to be found, as there are in Chrome, Opera, Edge, etc. Given that the Tor Browser is built on top of Firefox, it's a huge loss for everyone that Firefox is not being included in the attacks; the vulnerabilities that the white-hats find would be reported and promptly plugged, rather than left open for nefarious three-letter agencies to exploit.
  - noja 10y ago
    > Reasons aside No. Reasons not aside. Reasons are very important.
    - AdmiralAsshat 10y ago
      If we don't know what the reason was, and they won't elaborate on it, what importance does it have? Pwn2Own 2016 already happened. Firefox wasn't included, for whatever reason. The damage is already done at this point, as its exclusion created the impression that it was "not worth attacking". If the guys had said, "We didn't bother with Firefox because they weren't willing to pay us as much as Google or Microsoft", okay. But they didn't. What they said was: 'We wanted to focus on the browsers that have made serious security improvements in the last year,' Brian Gorenc, manager of Vulnerability Research at HPE said." And now Firefox looks weak by comparison.

coldpie 10y ago

The incorrect system time detection is a small feature, but actually pretty neat. I've run into that before, when testing time-sensitive features in my software and forgetting to change it back, then wondering why on Earth nothing secure works anymore.

chrisper 10y ago
Any reason why you would not try time-sensitive stuff in a VM?
- coldpie 10y ago
  Easier to change the system clock than set up a VM :P Especially for macOS.
BuuQu9hu 10y ago
Anyone know how it detects the system time is wrong?

mard 10y ago

It's a step in right direction, but would certainly feel safer if in addition to cookies/storage/geolocation permissions, Firefox allowed to whitelist JavaScript on certain domains out of box, with no need to resort to NoScript. Using NoScript results in two different whitelist mechanisms with completely different UI which breaks the browsing experience. Ironically, as far as "privacy-oriented browsers" go, Chrome has domain whitelisting of Cookies/JS/Plugins easily accessible from address bar and it works as expected.

agumonkey 10y ago

Nice post, it's hard to realize progress made in secondary UI elements such as security panels.

w8rbt 10y ago

I run FireFox on Linux for personal on-line banking. It's the only browser that I am able to run with Tomoyo Linux in enforcing mode (level 3). I'm sure, if given enough time, I could build a Tomoyo policy for Chrome, but it's far more verbose than FireFox and the last few times I tried, I gave up.

hackuser 10y ago
If you don't mind answering: How usable is Tomoyo for you overall? How much extra time does it consume? Are there things that just don't run? Are there many bugs in applications that do run? (Also, which distro are you using?) Thanks!
- w8rbt 10y ago
  Debian 8. I find Tomoyo to be the most usable of the LSMs. You can be up and running in a few days with rather complex policies. I could not get Chrome to work with it. It just reads and writes all over the place in ways that are hard to manage. No bugs yet.

drdaeman 10y ago

Am I only the one who finds "new" (well, it was there for about an year, I believe) "Site Identity and Permissions Panel" panel to be literally useless for the "site identity" part? It has no information on CA, whenever it's first time you saw this exact certificate or not, whenever a "weak" or "strong" ciphers are used (and if PFS is enabled), etc - things one'd really want to see if they care about their connection encryption and authentication. It's all still available, but hidden after long sequence of button clicks. Heck, it would be useful to have client certificate and HTTP auth status there as well - it would actually make those nice things closer to being usable. I really fail to understand why it can't be displayed in a sanely concise manner - and why things that were there before were removed. Surely there's a plenty of screen space and it's not like it would scare Joe Sixpack off to Chrome, or confuse anyone. Or analytics show it otherwise?

leeoniya 10y ago
i'm also not a fan of all the ui reduction and "simplification" just for the sake of a refresh. needless to say the only reason i'm still able to use firefox is Classic Theme Restorer. Once that is unable to run, i'll be off to Opera or Ungoogled Chromium or maybe Servo (hopefully we get a few years for "power" users before that gets gutted too)
past 10y ago
There have been a number of user studies done by Mozilla and other browser vendors that clearly show end users only have a basic grasp of the security properties of the web. So yes, more details in main UI elements leads to confusion. It's just 2 clicks for those of us who know what a certificate is (Ctrl/Cmd-I is even faster).
- drdaeman 10y ago
  > It's just 2 clicks Three, actually. One on the i+lock icon pair, one on the right-pointing arrow, then one on "more info". If I'd need more details (like issue and expiry dates, which is pretty common thing to be interested in), then it's 1 more button "view certificate". And if I'd happen to be interested in certificate public key properties (algorithm and key size) it's a really long story, 6 clicks away from the address bar. It certainly makes sense to not show something right away, on the first click. But the current UI hides quite essential information (to those who can understand it) way too deep. I'm really not persuaded it would hurt usability and confuse users if such information would be 2 clicks away, rather than 4-6. (And, really, it mustn't hurt to show at least "have I visited this page prior to today? yep, 234 times" on the very first click. And probably won't confuse anyone much to also see something like "TLS1.2, modern ciphers" or "TLS1.0, legacy ciphers".) > Ctrl/Cmd-I Toggles bookmarks sidebar for me. I'm unaware of any shortcut to open page info.

sgustard 10y ago

The status "Use the Camera - Allow - X" can be confusing. Is the site currently allowed to use the camera, or not? The word Allow could either mean "currently allowed" or "click to allow." The X could mean either "currently blocked" or "click to block."

spacehunt 10y ago
The X has a tooltip that says "Clear this permission and ask again" so it's quite clear to me.
- azdle 10y ago
  Right, but it would be much more clear, without needing to read the tooltip, if it just said "Allowed - X", which IMHO is pretty clear that it is currently allowed and can be revoked with the 'X'.
  - MichaelGG 10y ago
    Agree - this was the first thought I had and came here to comment on it. When using the UI it's a bit more clear: you can't click "Allow". But just looking at the screenshot, I had the impression this was a request dialog somehow. I thought Allow was clickable to give permission, and the X was to dismiss being told the site wanted to know about the permission request. The little X doesn't seem like a common UI element to indicate "block", but it's probably ugly to say "Allowed - [Block]". Another idea might be to write "Currently allowed" or "This site has access to" under the word "Permissions".
dao- 10y ago
Filed https://bugzilla.mozilla.org/show_bug.cgi?id=1331172 https://bugzilla.mozilla.org/show_bug.cgi?id=1331172

mossby 10y ago

Did Firefox unbloat yet?

nfriedly 10y ago

> In the new design, permission prompts stay up even when you interact with the page. I think this is going to be a nice improvement. It was way to easy to "loose" the permissions dialog in the older flow.

bhauer 10y ago

Awesome changes. One suggestion: In the Control Center™, I would recommend using the past-tense for the current state. E.g., Receive Notifications Allowed X Access Your Location Allowed X Maintain Offline Storage Allowed X As it exists in the screenshots, the present tense is used, and the X button seems to be associated with the word "Allow." Further clarification could be achieved by making the X button actually say "Disallow" and giving it a border separate from the word "Allowed." E.g., Receive Notifications Allowed [Disallow]

toggle 10y ago
> Further clarification could be achieved by making the X button actually say "Disallow" and giving it a border separate from the word "Allowed." I agree. An X usually means "close" or "hide this thing," whereas here they're using it to change a setting. It really looks like there should be a toggle switch there.
- past 10y ago
  This is exactly right that X means "close" or "hide this thing" and this is what it does in this case as well: it removes the non-default setting and hides the list item.
dao- 10y ago
Filed https://bugzilla.mozilla.org/show_bug.cgi?id=1331172 https://bugzilla.mozilla.org/show_bug.cgi?id=1331172
past 10y ago
Thanks for the suggestion, this has now been fixed.

Auzy 10y ago

I love firefox.. My big problem as a late though seems to be that sites stop loading intermittently, need to be refreshed or I need to wait (and I don't have this problem on Chrome). Also, I got kind of annoyed when one of their leaders came begging for donations by email, but are getting paid FAR beyond normal wage.

Dylan16807 10y ago

Making it easy to see permissions for the current site is great, but why is there no way to see all the sites that have special permissions? Firefox used to have about:permissions but that was removed last year.

past 10y ago
about:permissions was an incomplete experimental UI, but a fully functional replacement is high on our priority list. We are waiting on a new design from the UX team at the moment.

khana 10y ago

I'm excited to see FF undertake security this way. It's the right thing to do.

Hydraulix989 10y ago

Extensions still run in Private Tabs, unlike with Chrome, so they are free to phone home about your private browsing as much as they'd like. This is the real privacy hole that still needs to be fixed.