SecurityEngineering/PlatformFeatureComparison

Feature	Desktop	Fennec	iOS	notes

UIA

Popup blocker	Yes	Yes	Yes

File download	Yes	No	No	File downloads not supported currently on iOS.



Local file access

Save local files to location	Yes	Yes	No	Fx on desktop download location is configurable, while it is a fixed location on Fennec. File downloads are not supported currently on iOS.

Open/save file prompt	Yes	No	No	On Fennec, files are auto-saved to disk. On iOS, fiile downloads not currently supported.

Local file security	Yes	Yes	No	Users of iOS devices do not have direct access to the file system



Location bar

Domain highlighting	Yes	Yes	Yes

Trim URL	Yes	Yes	Yes	Fx trims only the http scheme, while Safari/Chrome also trim URI.



Other UI

Context menu	Yes	Yes	Yes	Slides from the bottom of the screen on iOS.

Doorhanger	Yes	Yes	Yes	Fennec uses a popup, while Fx on iOS uses modal windows.

Dropdowns	Yes	No	No	Does not appear to be supported on platforms that don't support plugins.



Safe browsing

Malware	Yes	Yes	No	https://www.itisatrap.org/firefox/its-an-attack.html

Phishing	Yes	Yes	No	https://www.itisatrap.org/firefox/its-a-trap.html

Download protection	Yes	No	No

Unwanted software	Yes	Yes	No	https://www.itisatrap.org/firefox/unwanted.html



Other permissions

Geolocation	Yes	Yes	Yes	On iOS, uses modal prompt.

Notifications	Yes	Yes	No	https://developer.mozilla.org/en-US/docs/Web/API/notification https://pdehaan.github.io/push-notification-test/

Camera/microphone	Yes	Yes	No	On iOS, you can check Camera/Mic permissions under Settings -> Privacy (Microphone & Camera



Full screen	Yes	Yes	No	https://developer.mozilla.org/samples/domref/fullscreen.html http://html5-demos.appspot.com/static/fullscreen.html

Auto updates	Yes	Yes	Yes

Site preferences	No	No	No	about:permissions has been removed from Nightly



Add-ons



Blocklisting	Yes	Yes	No

Click-to-play	Yes	No	No	Safari on iOS doesn't support plug-ins so I'm assuming that FX won't be able to use plugins as well, meaning blocklisting and the dropdowns won't be supported under fx.



Passwords

Per site	Yes	Yes	Yes

Master Password	Yes	Yes	No

Manage Passwords/Logins	Yes	Yes	No



Sync

Prefs	Yes	Yes	No

Passwords	Yes	Yes	Yes



Privacy

Private browsing	Yes	Yes	Yes

Guest mode	No	Yes	No

Tracking protection	Yes	Yes	No



DNT	Yes	Yes	No	http://donottrack.us/

Clear private data options	Browsing & Download history Form & Search History Cookies & active logins Saved logins Cache Offline website data Site settings	Browsing & Download history Form & Search History Cookies & active logins Saved logins Cache Offline website data Site preferences	Browsing History Cache Cookies Offline Website Data Saved Logins

Third party cookies	always, visited only, disabled	always, disabled	No	Fx for iOS lacks UI for disabling cookies in general.

Telemetry control	Yes	Yes	No

Crash reporter	Yes	Yes	Yes

Health report	Yes	Yes	No

Location Service	No	Yes	No

Offline data / appcache notify	Yes	No	No



SSL

Cert store management	Yes	No	No

OCSP	Yes	Yes	Yes	https://www.ssllabs.com/ssltest/viewMyClient.html (OSCP stapling)

HSTS	Yes	Yes	Yes

HPKP	Yes	Yes	No	security.cert_pinning.enforcement_level

Choose cipher suites	Yes	Yes	No

TLS fallback	Yes	Yes	No	security.tls.version.fallback-limit

TLS version	Yes	Yes	No	security.tls.version.min



Supported cipher suites				about:config --> security.ssl3

TLS_DHE_RSA_WITH_AES_128_CBC_SHA	Yes	Yes	No

TLS_DHE_RSA_WITH_AES_256_CBC_SHA	Yes	Yes	No

TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA	No	No	Yes

TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA	Yes	Yes	Yes

TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256	No	No	Yes

TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256	Yes	Yes	Yes

TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA	Yes	Yes	Yes

TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384	No	No	Yes

TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384	No	No	Yes

TLS_ECDHE_ECDSA_WITH_RC4_128_SHA	No	No	Yes

TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA	No	No	Yes

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA	Yes	Yes	Yes

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256	No	No	Yes

TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256	Yes	Yes	Yes

TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA	Yes	Yes	Yes

TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384	No	No	Yes

TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384	No	No	Yes

TLS_ECDHE_RSA_WITH_RC4_128_SHA	No	No	Yes

TLS_EMPTY_RENEGOTIATION_INFO_SCSV	No	No	Yes

TLS_RSA_WITH_3DES_EDE_CBC_SHA	Yes	Yes	Yes

TLS_RSA_WITH_AES_128_CBC_SHA	Yes	Yes	Yes

TLS_RSA_WITH_AES_128_CBC_SHA256	No	No	Yes

TLS_RSA_WITH_AES_128_GCM_SHA256	No	No	Yes

TLS_RSA_WITH_AES_256_CBC_SHA	Yes	Yes	Yes

TLS_RSA_WITH_AES_256_CBC_SHA256	No	No	Yes

TLS_RSA_WITH_AES_256_GCM_SHA256	No	No	Yes

TLS_RSA_WITH_RC4_128_MD5	No	No	Yes

TLS_RSA_WITH_RC4_128_SHA	No	No	Yes



UI

Padlock states

Cert/connection encryption	Yes	Yes	Yes

Mixed content	Yes	Yes	No



EV indicator	Yes	Yes	No	https://www.paypal.com

https://www.ssl.com/



Error pages	-

Report	Yes	No	No	For iOS, unable to find site that triggers appropriate page

Override	Yes	Yes	No	On iOS, we receive [NSURLErrorDomain].



Misc:	-

alpn	Yes	Yes	Yes

false_start	Yes	Yes	Yes

npn	Yes	Yes	Yes

require_safe_negotiation	Yes (default is false)	Yes (default is false)	Unknown	Fx for iOS supports secure renegotiation, but we don't see a way to turn it off.

warn_missing_rfc5746	Yes	Yes	Unknown	Fx for iOS supports secure renegotiation, but we don't see a way to configure it.







iOS/Webkit features

iOS9 content blocking	No	No	No	iOS9 includes a content blocking API that can be used by third party apps.. Once you've download an app, you can enable it via Settings -> Safari -> Content Blockers... FX doesn't use this functionality and only works for Safari.





Other:



Information:

List of available trusted root certificates in iOS 9

			https://support.apple.com/en-us/HT205205



Schemes



True schemes	http, https, file, jar (...)	http, https, file, jar (...)	http://, https://, ftp://,

Pseudo	view-cache, view-source (...)		mailto://, tel://, facetime://, sms://,

javascript: in location bar