There has been a lot of buzz about a Firefox add-on named Firesheep.  I have kind of ignored the topic for some time, but after getting a few emails from Firefox users asking what it is about – I thought it might be time to shed some light on the topic – so that all Firefox users know it is out there.  Firesheep snoops fro cookies, and then allows others to log into websites as you if you are browsing on an open wireless network.

Mozilla has said it would not (or could not) put in a kill switch to disable the Firesheep add-on from stealing log-on and account access information to Facebook, Twitter and other major website services out there. The reason for this is because it does not exploit a vulnerability in Firefox – it exploits a whole in a number of popular websites instead.

So what you can do to protect yourself, if you often browse from an open wireless network? Download Squad has put together a great guide on how to defend against Firesheep by surfing securely with HTTPS. Sebastian has done a great job at giving you all the details you need to know there.

Now, before you go searching for Firesheep on your own – let me warn you.  While downloading Firesheep and Firesheep itself is not illegal, using Firesheep to login as somebody else (so the process of using the add-on) is illegal under US law.

Hopefully the attention this add-on has drawn will create enough buzz to get some of the biggest websites out there today to fix this hole and better protect their users.

Here is what the page looks like (via F-Secure):

Then, the download box will automatically appear asking you to save the file, “ff-update.exe” or something very similar to it.  If you do that, then you have successfully installed the virus.

It looks like virus and malware authors are targeting Firefox users, as they would bank users – trying to make you feel like your on a safe place with a page that looks like it belongs to Mozilla.

So be safe out there, and make sure to check and double check anytime your dealing with downloads in any browser out there.

It looks as if Dell is going into the browser business, with its virtualized version of Firefox.  The idea here is to provide the users a virtual instance of the browser, so that malware and other bad things can’t reach your main system files. This in turn would reduce your overall exposure to drive-by malware attacks from websites that might host malicious code.

Not to get too geeky, by keeping the browser and the rest of the PC in two separate environments – hopefully this will lessen the chance you have of being totally hosed if you happen to stumble across a bad part of the web out there.  Dell has also renamed their version of Firefox to the Dell Kace Secure Browser.

Here are some of the features:

• Provides a virtualized and contained Firefox v3.6 Browser with Adobe Reader and Flash plug-ins
• Rapidly reset any changes made during normal use back to their initial state, enabling easy recovery from infections or attacks
• View statistics related to the number of processes detected and blocked
• Set white and black lists to limit access to known good sites, or prevent access to known bad sites to further limit the risk of attack and infection

If you want to try it out for yourself, you can download the Dell Kace Secure Browser from Dell’s website.

The master password in Firefox is used to add another layer of security to your password system.  What would happen though if you setup a master password, got in an accident, were in a coma for six months, and then once you awoke you couldn’t remember what your master password was set to?  I’ll help you reset or recover your Firefox master password with one simple tool.

Recover the Firefox Master Password with FireMaster

FireMaster claims to be the first ever tool built to recover the lost master password in Firefox.  In all honesty, you are really hacking yourself – because the tool uses a combination of techniques such as dictionary, hybrid and brute force to recover the master password from the Firefox key database file.  Desperate times sometimes call for desperate measures.

You can pick up your own version of the digital download here.

Resetting the Master Password in Firefox

When you reset the master password in Firefox, you will remove all the stored password information – so that is not a very good route to go, if you really need that login information back. 

With that warning said – point your browser towards:

chrome://pippki/content/resetpassword.xul

Copy and paste that into your address bar, then hit the Enter key. upon doing so you will be asked if you really want to reset the master password, and remove your stored information, passwords, private keys and more.  Click the Reset button to reset the Firefox master password for good.

So there you have two route to take next time you awake from your own six month coma. The best route of all to take would be do not forget your password, but if your finding this from a Google search – it might be too late for sage words.

Want to hide what it is you have been looking for?  Not the perfect solution, but perfect for nit-picky peeps is the Clear Search add-on for Firefox.

What does this browser extension do?  It does one job, and it does it really well.  Once installed, it automatically clears the search bar after performing a search. So if you have a nosey roommate or family member, they won’t accidently see you have been searching for the top 10 horror villains of all time.

While this add-on for the browser isn’t enough to prevent somebody who is really nosey from going through your history, and doing a full scale investigation – it does serve the simple task or clearing out your search box after a search very well.  You can pick up the Clear Search extension on the Firefox add-ons web site.

Ever lost something you just typed into a web form, and wanted to get it back? Lazarus: Form Recovery, a security related add-on for Firefox, will auto-save anything you type into forms as you type. 

Have a server crash?

Did the page timeout?

Did Firefox go down an a blaze of glory? 

No matter what the problem, you can go back to the form, right-click your mouse, choose “recover form” and get your information back.

Here is a little more information about Lazarus: Form Recovery from the add-on developer:

Lazarus works on web forms, WYSIWYG editors and AJAXified forms and will save you from almost any given server, browser, or connection problems that might otherwise cause you to lose your work.  Lazarus now comes with 2048-bit RSA and 256-bit AES hybrid encryption so your data is more secure than ever! Lazarus 2.0 also includes search functionality so you can recover text even if you can no longer find the original form you entered it into.

If you often run into the situation where you just lost what you typed, this add-on for Firefox is your perfect proverbial right-hand man.  You can pickup the Lazarus: Form Recovery add-on for Firefox from the Firefox Add-ons site.

Chances are this will be fixed sooner, rather than later – here is a little more about the story from The Register:

Security notification firm Secunia reports that the security bug (which it describes as extremely critical) stems from errors in handling JavaScript code. The flaw has been confirmed in the latest 3.5 version of Firefox, released in late June.

Older versions of the popular alternative browser might also be affected, Secunia warns.

Exploit code has been uploaded onto recently revived security exploit website milw0rm, a factor that could hasten the development of more attack code.

Secunia advises Firefox users to avoid browsing untrusted websites or following untrusted links pending the availability of a fix from Mozilla (there’s nothing in the pipeline just yet).

Best advice I can give to you is to browse safely, don’t go to web sites you don’t trust, and be sure to keep your security programs up to date.

UPDATE:

Found this via Mashable:

Until Mozilla addresses this vulnerability, here’s a temporary fix: Type about:config in Firefox address bar, and set “javascript.options.jit.content” to “false.”

So there is your fix for now.  Thanks to everybody who sent this in!

UPDATE #2:

This problem was fixed in Firefox 3.5.1, so the above hack from Mashable is no longer needed.  To check for updates, be sure to go to Help > “Check for Updates…” in Firefox.

Want to increase your privacy on your PC?  With the release of Firefox 3.5, our favorite browser now has a Private Browsing mode.  Usually your browser remembers the web sites you have visited, your user names and passwords, your browsing history and more.  However, with this newest addition to the Firefox 3.5 feature list, you can now go incognito on the Internet.

To turn on Private Browsing mode, go to Tools (in the menu bar) and then select Start Private Browsing.  You will then get a popup menu asking you if you would really like to start Private Browsing mode.  Hit the “Start Private Browsing” button to continue.

To be able to tell that you are in Private Browsing mode, the Firefox window title will show (Private Browsing) after the page title you are looking at.  When you are privately browsing, the browser will not remember:

• Visited pages
• Form and Search Bar entries
• Passwords
• Download List entries
• Cookies
• Cached files

If you create a new bookmark while in Private Browsing mode, you will keep it after turning Private Browsing mode off.  Also, if you save or download any files to your PC, those files will not be removed when you stop Private Browsing mode either (they will not though show up in the Downloads window).

To turn Private Browsing mode off, you will want to click on Tools in the menu bar, and the select Stop Private Browsing.  To confirm you have done this correctly, check the Firefox window’s title bar to make sure (Private Browsing) is no longer showing.

Quickly Turn Private Browsing On (or Off)

One tweak or suggestion for this new mode is to give the user a toolbar button to turn it on or off.  The Toggle Private Browsing add-on for Firefox does that.  It gives you the ability to switch between private browsing and regular browsing by adding a button to either the toolbar or status bar.

I hope that helps when it comes to learning the basics about the Private Browsing mode in Firefox.  How do you like it thus far, and how do you think this benefits the browser?

Once you install it, a small “P” icon will show up in your browser’s status bar.  All you have to do is click on it, and a password will be generated using the settings you have put in.  By default, the password will be shown to you and copied to your clipboard.  To change the options, all you need to do is right-click on the icon and select options.  From there you have a number of specific settings you can change, such as what the first and last characters start with, the password length, if you want to display the password or not or if you wish to copy the password to the clipboard or not.

Why use a complicated password?  Well, if a password is too short or simple, it is vulnerable to attack.  The simpler the password is, the easier time somebody will have to figure it out.  On the flip side, the more complicated the password, the harder it will be to figure out.

All in all, the pwgen – Password Generator extension for Firefox is a perfect one for those of you who may have a hard time coming up with a random mix of letters and numbers to use for your next secure password.

Here is a little more about the extension from the developer:

Unlike other earlier opt-out solutions, this tool will make the cookies completely persistent. That is, clearing the browser’s cookies will delete all other installed cookies, except these.  Users wishing to delete these 40+ cookies (some advertising networks require multiple cookies, for different domain names) must first remove the add-on, before then deleting all installed cookies from the preferences window.

For a list of the 33 advertising networks that this tool help you hide from, check out the developer’s official web site.  So if you are more than a little concerned about who is watching you, this is a great security related add-on to add to your Firefox install.  Who said tacos aren’t good for you?  This one will help protect your privacy!