4 ms·

I'm confused; if Firefox doesn't use the system certificates, shouldn't Firefox users have been seeing visibly broken HTTPS from day one?

by MBlume 12y ago

ptaipale 12y ago
It's not broken, because the Firefox certificate storage isn't empty when you install it. It includes the ones recognized by Mozilla. https://www.mozilla.org/en-US/about/governance/policies/security-group/certs/included/ https://www.mozilla.org/en-US/about/governance/policies/secu...
- MBlume 12y ago
  Sure, but I assume Mozilla doesn't recognize the Lenovo adware, so if all the web traffic is being routed through this proxy, shouldn't firefox have squawked?
  - HackinOut 12y ago
    Except if the adware just modify OS proxy settings, like madeofpalk mentioned. Firefox does not take those into account.
    - ptaipale 12y ago
      When taking Firefox into use, it imports the OS proxy settings, though. You get a warning but I guess about 99 % of people don't care about what that means.
  - ptaipale 12y ago
    Mozilla has its own proxy settings as well, independent of Windows Control Panel configuration, so a Firefox user appears not to be impacted by the whole thing at all.
    - dhimes 12y ago
      It's not clear to me. Just a few minutes ago (and after your post) this appeared on mozilla discussion forum given by [1] above (will come back to credit this- didn't copy and don't remember (and can't see!)). https://bugzilla.mozilla.org/show_bug.cgi?id=1134506 https://bugzilla.mozilla.org/show_bug.cgi?id=1134506 Down around 0200 PST 2015-02-19 EDIT: credit [1] cpeterso https://news.ycombinator.com/item?id=9072642 https://news.ycombinator.com/item?id=9072642
      - ptaipale 12y ago
        OK, so they might have added also a Firefox plugin that infects the Mozilla trusted CA list as well. I guess Firefox should block that plugin as malicious.
deleted 12y ago
[deleted]
madeofpalk 12y ago
I was equally confused. I'm guessing Firefox doesn't use the OS proxy settings, therefor wasn't getting MITM-ed
- MBlume 12y ago
  That's my current best guess too. Which would imply that Firefox users are...fine? Hopefully?
  - Manishearth 12y ago
    Perhaps not https://bugzilla.mozilla.org/show_bug.cgi?id=1134506#c19 https://bugzilla.mozilla.org/show_bug.cgi?id=1134506#c19
- HackinOut 12y ago
  It does not. Firefox has it's own implementation, which is pretty great (supports all kind of proxies/socks).

I'm confused; if Firefox doesn't use the system certificates, shouldn't Firefox users have been seeing visibly broken HTTPS from day one?

by MBlume 12y ago

I'm confused; if Firefox doesn't use the system certificates, shouldn't Firefox users have been seeing visibly broken HTTPS from day one?

ptaipale 12y ago

It's not broken, because the Firefox certificate storage isn't empty when you install it. It includes the ones recognized by Mozilla. https://www.mozilla.org/en-US/about/governance/policies/security-group/certs/included/ https://www.mozilla.org/en-US/about/governance/policies/secu...

MBlume 12y ago
Sure, but I assume Mozilla doesn't recognize the Lenovo adware, so if all the web traffic is being routed through this proxy, shouldn't firefox have squawked?
- HackinOut 12y ago
  Except if the adware just modify OS proxy settings, like madeofpalk mentioned. Firefox does not take those into account.
  - ptaipale 12y ago
    When taking Firefox into use, it imports the OS proxy settings, though. You get a warning but I guess about 99 % of people don't care about what that means.
- ptaipale 12y ago
  Mozilla has its own proxy settings as well, independent of Windows Control Panel configuration, so a Firefox user appears not to be impacted by the whole thing at all.
  - dhimes 12y ago
    It's not clear to me. Just a few minutes ago (and after your post) this appeared on mozilla discussion forum given by [1] above (will come back to credit this- didn't copy and don't remember (and can't see!)). https://bugzilla.mozilla.org/show_bug.cgi?id=1134506 https://bugzilla.mozilla.org/show_bug.cgi?id=1134506 Down around 0200 PST 2015-02-19 EDIT: credit [1] cpeterso https://news.ycombinator.com/item?id=9072642 https://news.ycombinator.com/item?id=9072642
    - ptaipale 12y ago
      OK, so they might have added also a Firefox plugin that infects the Mozilla trusted CA list as well. I guess Firefox should block that plugin as malicious.

deleted 12y ago

[deleted]

madeofpalk 12y ago

I was equally confused. I'm guessing Firefox doesn't use the OS proxy settings, therefor wasn't getting MITM-ed

MBlume 12y ago
That's my current best guess too. Which would imply that Firefox users are...fine? Hopefully?
- Manishearth 12y ago
  Perhaps not https://bugzilla.mozilla.org/show_bug.cgi?id=1134506#c19 https://bugzilla.mozilla.org/show_bug.cgi?id=1134506#c19
HackinOut 12y ago
It does not. Firefox has it's own implementation, which is pretty great (supports all kind of proxies/socks).