1
edit
Firefox/Feature Brainstorming:Security: Difference between revisions
Jump to navigation
Jump to search
m
Firefox/Feature Brainstorming:Security (view source)
Revision as of 14:42, 16 October 2011
, 16 October 2011no edit summary
Quencha8760 (talk | contribs) No edit summary |
Mahfujalubna (talk | contribs) mNo edit summary |
||
| Line 18: | Line 18: | ||
<tr><td> | <tr><td> | ||
; An additional strategy for whitelisting | ; An additional strategy for whitelisting | ||
An additional strategy for whitelisting could be that we have a universal directory maintained by people. This directory will have the pages where the user can enter the ID and password for that site. FF could show the user by means like address bar colour that he is entering the right site. So we have people, like citibank, paypal, yahoo, indiatimes, rediff etc., giving the pages where the user can logon from, to this directory. This will help user overcome the recent flaw discovered in IE and FF as well as provide better phishing protection. | An additional strategy for whitelisting could be that we have a universal directory maintained by people. This directory will have the pages where the user can enter the ID and password for that site. FF could show the user by means like address bar colour that he <span class="plainlinks">[http://www.kidney-stones-symptoms-cure.com/ <span style="color:black;font-weight:normal; text-decoration:none!important; background:none!important; text-decoration:none;">symptoms of kidney stones</span>] is entering the right site. So we have people, like citibank, paypal, yahoo, indiatimes, rediff etc., giving the pages where the user can logon from, to this directory. This will help user overcome the recent flaw discovered in IE and FF as well as provide better phishing protection. | ||
</td><td> | </td><td> | ||
Phishing protection ( below)<br> | Phishing protection ( below)<br> | ||
| Line 91: | Line 91: | ||
** When a user registers with a site, the browser submits a request to the site to send back a password (let's name this password the site password). This password is kept by the browser in the password list. When the user tries to login into a site, the browser sends the user password to the site and the site sends back the site password; then the browser compares the site password with the one stored internally and if they don't match, the site is not displayed in the browser. With bi-directional registration, both sides (the user and the site) must submit a password to each other in order to view the site. A phishing site can not know the site password (unless the original site is compromised during registration), so users are safe, even in the presence of identical web pages or domain names. | ** When a user registers with a site, the browser submits a request to the site to send back a password (let's name this password the site password). This password is kept by the browser in the password list. When the user tries to login into a site, the browser sends the user password to the site and the site sends back the site password; then the browser compares the site password with the one stored internally and if they don't match, the site is not displayed in the browser. With bi-directional registration, both sides (the user and the site) must submit a password to each other in order to view the site. A phishing site can not know the site password (unless the original site is compromised during registration), so users are safe, even in the presence of identical web pages or domain names. | ||
** This approach requires a little more work from the web applications that must generate, keep and send site passwords. But from the client side, it is a flexible solution that can be automated at browser level. | ** This approach requires a little more work from the web applications that must generate, keep and send site passwords. But from the client side, it is a flexible solution that can be automated at browser level. | ||
* Alert on password reuse: All passwords submitted on trusted sites have a cryptographic hash stored and the browser prevent submission of any of these password on untrusted sites forms. The confirmation message box could teach users about using different passwords on untrusted sites too. The check could be performed on the fly as user enter text, field value should not be trusted to prevent password scrambling before submission. Alert flag can be set on each matching keypress and should remain set if text gets longer. | * Alert on password reuse: All passwords submitted on trusted sites have a cryptographic hash stored and the browser prevent submission of any of these password on untrusted sites forms. The confirmation message box could teach users about using different passwords on untrusted sites too. <span class="plainlinks">[http://www.gallbladderdetox.com/gall-bladder-symptoms/ <span style="color:black;font-weight:normal; text-decoration:none!important; background:none!important; text-decoration:none;">gall bladder symptoms</span>] The check could be performed on the fly as user enter text, field value should not be trusted to prevent password scrambling before submission. Alert flag can be set on each matching keypress and should remain set if text gets longer. | ||
</td><td> | </td><td> | ||
certificate whitelisting - in German [http://www.hauke-laging.de/ideen/bsi-zertifikatsplugin/] | certificate whitelisting - in German [http://www.hauke-laging.de/ideen/bsi-zertifikatsplugin/] | ||
| Line 163: | Line 163: | ||
* Never accept cookies associated with invisuble images: single, pixel GIFs and so forth | * Never accept cookies associated with invisuble images: single, pixel GIFs and so forth | ||
* Extensions like "Extended Cookie Manager" allow you to enable or disable cookies for the current site. However, it is common that sites use redirection, and a different site for actual authentication. Something like login.google.com when browsing www.google.com. So, simple "enable cookies for this site" features are not effective. | * Extensions like "Extended Cookie Manager" allow you to enable or disable cookies for the current site. However, it is common that sites use redirection, and a different site for actual authentication. Something like login.google.com when browsing www.google.com. So, simple "enable cookies for this site" features are not effective. | ||
* The "ask every time" cookie dialog box should have another checkbox: "Don't ask again". This is so you can deny a cookie, and not have many more dialogs pop up to deny. | * The "ask every time" cookie dialog box should have another checkbox: "Don't ask again". This is so you can deny a cookie, and not have many more dialogs pop up to deny.<span class="plainlinks">[http://www.gallbladderdetox.com/gall-bladder-symptoms/ <span style="color:black;font-weight:normal; text-decoration:none!important; background:none!important; text-decoration:none;">gall bladder symptoms</span>] This would complement a "One-click block/allow cookies" feature. | ||
* More granular cookie controls - allowing regex definitions of what cookies should be accepted or declined. Not just based on the source site but also on the contents of the cookie. E.g. I don't care what site it is from, I never want to accept a cookie that contains the string AD_ID, even if I accept other cookies from a site. | * More granular cookie controls - allowing regex definitions of what cookies should be accepted or declined. Not just based on the source site but also on the contents of the cookie. E.g. I don't care what site it is from, I never want to accept a cookie that contains the string AD_ID, even if I accept other cookies from a site. | ||
* Have an option to automatically allow session cookies, even if I asked to ask every time, like in Internet Explorer. The main use of asking every time is to be able to allow permanent cookies only for those sites you trust, and to make every one else to last only for the session. But session cookies will do it anyway, so it's a waste of time having to opt in each one. | * Have an option to automatically allow session cookies, even if I asked to ask every time, like in Internet Explorer. The main use of asking every time is to be able to allow permanent cookies only for those sites you trust, and to make every one else to last only for the session. But session cookies will do it anyway, so it's a waste of time having to opt in each one. | ||
| Line 296: | Line 296: | ||
One solution could be to provide an extra button in the alert and other pop-up dialogs to close the tab. This would also be viable for breaking the Javascript Execution loops(See below). | One solution could be to provide an extra button in the alert and other pop-up dialogs to close the tab. This would also be viable for breaking the Javascript Execution loops(See below). | ||
I have seen sites (related to porntube) that force users to install malicious software (like a video viewer) in this way. Most browser users haven't the skills to start taskmanager, looking up the Firefox process and then kill it after having the guts to risk system instability (as the windows popup warns for). Their other two common options to end this are trying to log out or simply cutting the power. | I have seen sites (related to porntube) that force users to install malicious software (like a video viewer) in this way. Most browser users haven't the skills to start taskmanager, looking up the Firefox process and then kill it after having the guts to risk system instability (as the windows popup warns for). Their other two common options to end this are trying to log out or simply cutting the power.<span class="plainlinks">[http://www.kidney-stones-symptoms-cure.com/ <span style="color:black;font-weight:normal; text-decoration:none!important; background:none!important; text-decoration:none;">symptoms of kidney stones</span>] | ||
So, there has to come a far more easier way to abort such exploits. | So, there has to come a far more easier way to abort such exploits. | ||