SecurityEngineering/PlatformFeatureComparison
Firefox Security and Privacy Features Across Platforms
Compiled December, 2015 by Kamil Jozwiak and Matt Wobensmith
| Feature | Desktop | Fennec | iOS | notes |
| UIA | ||||
| Popup blocker | Yes | Yes | Yes | |
| File download | Yes | No | No | File downloads not supported currently on iOS. |
| Local file access | ||||
| Save local files to location | Yes | Yes | No | Fx on desktop download location is configurable, while it is a fixed location on Fennec. File downloads are not supported currently on iOS. |
| Open/save file prompt | Yes | No | No | On Fennec, files are auto-saved to disk. On iOS, fiile downloads not currently supported. |
| Local file security | Yes | Yes | No | Users of iOS devices do not have direct access to the file system |
| Location bar | ||||
| Domain highlighting | Yes | Yes | Yes | |
| Trim URL | Yes | Yes | Yes | Fx trims only the http scheme, while Safari/Chrome also trim URI. |
| Other UI | ||||
| Context menu | Yes | Yes | Yes | Slides from the bottom of the screen on iOS. |
| Doorhanger | Yes | Yes | Yes | Fennec uses a popup, while Fx on iOS uses modal windows. |
| Dropdowns | Yes | No | No | Does not appear to be supported on platforms that don't support plugins. |
| Safe browsing | ||||
| Malware | Yes | Yes | No | https://www.itisatrap.org/firefox/its-an-attack.html |
| Phishing | Yes | Yes | No | https://www.itisatrap.org/firefox/its-a-trap.html |
| Download protection | Yes | No | No | |
| Unwanted software | Yes | Yes | No | https://www.itisatrap.org/firefox/unwanted.html |
| Other permissions | ||||
| Geolocation | Yes | Yes | Yes | On iOS, uses modal prompt. |
| Notifications | Yes | Yes | No | https://developer.mozilla.org/en-US/docs/Web/API/notification https://pdehaan.github.io/push-notification-test/ |
| Camera/microphone | Yes | Yes | No | On iOS, you can check Camera/Mic permissions under Settings -> Privacy (Microphone & Camera |
| Full screen | Yes | Yes | No | https://developer.mozilla.org/samples/domref/fullscreen.html http://html5-demos.appspot.com/static/fullscreen.html |
| Auto updates | Yes | Yes | Yes | |
| Site preferences | No | No | No | about:permissions has been removed from Nightly |
| Add-ons | ||||
| Blocklisting | Yes | Yes | No | |
| Click-to-play | Yes | No | No | Safari on iOS doesn't support plug-ins so I'm assuming that FX won't be able to use plugins as well, meaning blocklisting and the dropdowns won't be supported under fx. |
| Passwords | ||||
| Per site | Yes | Yes | Yes | |
| Master Password | Yes | Yes | No | |
| Manage Passwords/Logins | Yes | Yes | No | |
| Sync | ||||
| Prefs | Yes | Yes | No | |
| Passwords | Yes | Yes | Yes | |
| Privacy | ||||
| Private browsing | Yes | Yes | Yes | |
| Guest mode | No | Yes | No | |
| Tracking protection | Yes | Yes | No | |
| DNT | Yes | Yes | No | http://donottrack.us/ |
| Clear private data options | Browsing & Download history
Form & Search History Cookies & active logins Saved logins Cache Offline website data Site settings |
Browsing & Download history
Form & Search History Cookies & active logins Saved logins Cache Offline website data Site preferences |
Browsing History
Cache Cookies Offline Website Data Saved Logins | |
| Third party cookies | always, visited only, disabled | always, disabled | No | Fx for iOS lacks UI for disabling cookies in general. |
| Telemetry control | Yes | Yes | No | |
| Crash reporter | Yes | Yes | Yes | |
| Health report | Yes | Yes | No | |
| Location Service | No | Yes | No | |
| Offline data / appcache notify | Yes | No | No | |
| SSL | ||||
| Cert store management | Yes | No | No | |
| OCSP | Yes | Yes | Yes | https://www.ssllabs.com/ssltest/viewMyClient.html (OSCP stapling) |
| HSTS | Yes | Yes | Yes | |
| HPKP | Yes | Yes | No | security.cert_pinning.enforcement_level |
| Choose cipher suites | Yes | Yes | No | |
| TLS fallback | Yes | Yes | No | security.tls.version.fallback-limit |
| TLS version | Yes | Yes | No | security.tls.version.min |
| Supported cipher suites | about:config --> security.ssl3 | |||
| TLS_DHE_RSA_WITH_AES_128_CBC_SHA | Yes | Yes | No | |
| TLS_DHE_RSA_WITH_AES_256_CBC_SHA | Yes | Yes | No | |
| TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA | No | No | Yes | |
| TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA | Yes | Yes | Yes | |
| TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 | No | No | Yes | |
| TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 | Yes | Yes | Yes | |
| TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA | Yes | Yes | Yes | |
| TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 | No | No | Yes | |
| TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 | No | No | Yes | |
| TLS_ECDHE_ECDSA_WITH_RC4_128_SHA | No | No | Yes | |
| TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA | No | No | Yes | |
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA | Yes | Yes | Yes | |
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 | No | No | Yes | |
| TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 | Yes | Yes | Yes | |
| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA | Yes | Yes | Yes | |
| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 | No | No | Yes | |
| TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 | No | No | Yes | |
| TLS_ECDHE_RSA_WITH_RC4_128_SHA | No | No | Yes | |
| TLS_EMPTY_RENEGOTIATION_INFO_SCSV | No | No | Yes | |
| TLS_RSA_WITH_3DES_EDE_CBC_SHA | Yes | Yes | Yes | |
| TLS_RSA_WITH_AES_128_CBC_SHA | Yes | Yes | Yes | |
| TLS_RSA_WITH_AES_128_CBC_SHA256 | No | No | Yes | |
| TLS_RSA_WITH_AES_128_GCM_SHA256 | No | No | Yes | |
| TLS_RSA_WITH_AES_256_CBC_SHA | Yes | Yes | Yes | |
| TLS_RSA_WITH_AES_256_CBC_SHA256 | No | No | Yes | |
| TLS_RSA_WITH_AES_256_GCM_SHA256 | No | No | Yes | |
| TLS_RSA_WITH_RC4_128_MD5 | No | No | Yes | |
| TLS_RSA_WITH_RC4_128_SHA | No | No | Yes | |
| UI | ||||
| Padlock states | ||||
| Cert/connection encryption | Yes | Yes | Yes | |
| Mixed content | Yes | Yes | No | |
| EV indicator | Yes | Yes | No | https://www.paypal.com https://www.ssl.com/ |
| Error pages | - | |||
| Report | Yes | No | No | For iOS, unable to find site that triggers appropriate page |
| Override | Yes | Yes | No | On iOS, we receive [NSURLErrorDomain]. |
| Misc: | - | |||
| alpn | Yes | Yes | Yes | |
| false_start | Yes | Yes | Yes | |
| npn | Yes | Yes | Yes | |
| require_safe_negotiation | Yes (default is false) | Yes (default is false) | Unknown | Fx for iOS supports secure renegotiation, but we don't see a way to turn it off. |
| warn_missing_rfc5746 | Yes | Yes | Unknown | Fx for iOS supports secure renegotiation, but we don't see a way to configure it. |
| iOS/Webkit features | ||||
| iOS9 content blocking | No | No | No | iOS9 includes a content blocking API that can be used by third party apps.. Once you've download an app, you can enable it via Settings -> Safari -> Content Blockers... FX doesn't use this functionality and only works for Safari. |
| Other: | ||||
| Information: | ||||
| List of available trusted root certificates in iOS 9 | ||||
| https://support.apple.com/en-us/HT205205 | ||||
| Schemes | ||||
| True schemes | http, https, file, jar (...) | http, https, file, jar (...) | http://, https://, ftp://, | |
| Pseudo | view-cache, view-source (...) | mailto://, tel://, facetime://, sms://, | ||
| javascript: in location bar |