Yes, the Firefox updater uses SSL and other mechanisms to prevent man-in-the-middle attacks. The update payload itself is signed with a private key controlled

Yes, the Firefox updater uses SSL and other mechanisms to prevent man-in-the-middle attacks. The update payload itself is signed with a private key controlled directly by Mozilla, to avoid vulnerability to CA compromises [1]. The connection to the update server uses SSL and performs additional checks to ensure not only that the SSL certificate is valid, but that it matches one of a small list of known certs or issuers, so a bad CA can't issue a forged certificate [2][3]. [1]: https://wiki.mozilla.org/Security/Reviews/Firefox10/SilentUp.. https://wiki.mozilla.org/Security/Reviews/Firefox10/SilentUp.... [2]: https://bugzilla.mozilla.org/show_bug.cgi?id=544442#c24 https://bugzilla.mozilla.org/show_bug.cgi?id=544442#c24 [3]: https://bugzilla.mozilla.org/show_bug.cgi?id=583678 https://bugzilla.mozilla.org/show_bug.cgi?id=583678