What is Do Not Track?

The Federal Trade Commission, in early December, announced it would promote the addition of easier "do not track" mechanisms in web browsers out there but will not seek legislation that makes adding these controls to any web browser out there mandatory. So, like with most topics in the on going browser wars between Google, Mozilla and Microsoft everybody is claiming they are doing something first to help protect the users out there.

What About Private Browsing Mode?

Ah ha, I see you have been paying attention.  Yes, Firefox does have the private browsing mode embedded into the browser.  This feature simply prevents information about your browsing activity from being saved to the PC.  It does not make you anonymous on the Web. 

So, Are All Cookies Evil?

No, not all cookies are evil.  To take a step back, browser cookies are tiny text files stored on your PC from browsing that are set to remember certain things about you. Cookies are most often used for website authentication, storing website preferences, link click tracking and more. The scare factor here has to do with cookies from third parties, such as advertisers, and their ability to track more information about you. Most browsers, such as Mozilla Firefox, Internet Explorer and Chrome, do allow third-party cookies by default, though they allow users to block them.

Here is how I have my own Firefox set up to clear browser cookies and history each time I start Firefox up:

• Clear Junk When Firefox Closes

So the good news is that more privacy protection is coming to Firefox and all other browsers in 2011.  The question is do we really need protecting?

So, which domains can you look for bugs on?

• bugzilla.mozilla.org
• *.services.mozilla.com
• getpersonas.com
• aus*.mozilla.org
• www.mozilla.com/org
• www.firefox.com
• www.getfirefox.com
• addons.mozilla.org
• services.addons.mozilla.org
• versioncheck.addons.mozilla.org
• pfs.mozilla.org
• download.mozilla.org

Here is a little more information from Mozilla about the inclusion of web apps as a part of the bug bounty program.

Many people are not aware that we have paid the bounty in the past on web application security vulnerabilities which impact client security. We are, however, expanding the bounty beyond web vulnerabilities which just affect the client. We also feel we should have a more formal structure around our web properties when it comes to paying a bounty because our goal is to make our products and services more secure.

Happy hunting!  From more information on the bug bounty program, be sure to check out the FAQ posted over at Mozilla.org. It has tons of useful information.

Firefox should remember passwords by default.  If you have turned off or disabled this feature though, it might not.  Every so often, I need to use the Firefox password manager to remember a password, and it seems that for the life of me I can not get it to do it.  What might be the problem? Check your exceptions!

I can tell you that from experience, this accidental movement can prevent your passwords from being saved by the browser.  Take these steps to see if this might be the reason why your password hasn’t been saving:

• From the menu toolbar, go to Tools and then Options…
• Next, select the Security Panel
• Just to double check, if it isn’t already marked – make sure you check Remember passwords for sites
• Now, to the right of where it says, "Remember passwords for sites", click on the button labeled, Exceptions…
• Check the list, and make sure the website you are trying to log into is not on that list. If it is, just select the entry for the website – and click remove.

Now, close out those option windows and give it another shot. Firefox should now let you remember the password for the website in question now, if you had an entry to delete or you did not have the "Remember passwords for sites" option checked.

Due to privacy concerns, some Firefox users may wish to disable or turn off the session restore feature in Firefox. As an example, if your computer is used by multiple users, the browser could crash while you are checking your Gmail account.  Rather than restoring Firefox, you decide to go do something else.  When somebody else comes in to launch Firefox, the browser will be restored to your inbox (due to fact that is where it crashed).  If you want a little more browsing privacy, here is how you disable the session restore feature in the browser.

First thing you will need to do is visit our old friend, the about:config screen.  In the address bar, type in:

• about:config

and then press the "Enter" key.  If you are warned about the fact that you can really mess Firefox up if you muck around inside of about:config, just go ahead and click "I’ll be careful, I promise!" and continue.

Now, find browser.sessionstore.resume_from_crash in the list.  You will want to double-click that entry, and then set it to false.  Session restore inside of Firefox will now be disabled.

Here is what Mozilla has to say about the privacy issues that might exist:

Session Restore may keep you logged in to sites that you were logged into before you closed Firefox. If someone else used your computer after you, they could access your account on these sites. If this is a concern then you should not configure Firefox to open all windows and tabs from your previous session ("Show my windows and tabs from last time" option described above).

I would not consider this a huge privacy problem, but if it is something you are concerned about – it is nice to know Firefox left the option open for you.

After yesterday’s news about the fake Firefox update that is out there in the wild, I thought it might be a good time to go over how you can get your plugins updated.  Thankfully, Mozilla has made this really simple with the Plugin Check part of their website.

All you need to do is go to the Plugin Check website, and automatically your browser is scanned to make sure all your plugins are up to date. If you are up to date, you will see this badge here:

If you are not up to date, then you will see this badge here:

When you click the “Update” badge, as seen above – you will be taken to the official website for the plugin in question so that you can get it up to date.  This makes checking all your plugins and getting them updated so much easier. Some of the things it checks for include: Flash, Java, Silverlight, QuickTime, and more. (Those are the important ones though)

If it does not know what it is, or can not find the current version – then you get this kind of weird gray badge here:

When then will lead you to a Google search, when clicked, for “current version plugin (PLUGIN NAME HERE)”.  So you can go out on your own and probably find the update you need (if one is needed) within the first few results you get.

Hint: You can also get to Plugin Check, by going to Tools in the menu toolbar, then click Add-ons, then go to the Plugins section. Click the “Get Updates” button at the bottom of the window, and you will be taken to the Plugin Check website.

So, those are the basics when using the Plugin Check website Mozilla provides for all Firefox users.  For people who might not know there way around with updating this, that or the other – it makes the process of getting things updated a lot easier.

It looks as if Dell is going into the browser business, with its virtualized version of Firefox.  The idea here is to provide the users a virtual instance of the browser, so that malware and other bad things can’t reach your main system files. This in turn would reduce your overall exposure to drive-by malware attacks from websites that might host malicious code.

Not to get too geeky, by keeping the browser and the rest of the PC in two separate environments – hopefully this will lessen the chance you have of being totally hosed if you happen to stumble across a bad part of the web out there.  Dell has also renamed their version of Firefox to the Dell Kace Secure Browser.

Here are some of the features:

• Provides a virtualized and contained Firefox v3.6 Browser with Adobe Reader and Flash plug-ins
• Rapidly reset any changes made during normal use back to their initial state, enabling easy recovery from infections or attacks
• View statistics related to the number of processes detected and blocked
• Set white and black lists to limit access to known good sites, or prevent access to known bad sites to further limit the risk of attack and infection

If you want to try it out for yourself, you can download the Dell Kace Secure Browser from Dell’s website.

So we are to believe that Firefox and Chrome are both insecure, difficult to use, and unreliable?  The Internet Explorer team might want to check their calendars, because last time I checked – it is June 26th, not April 1st. 

If that isn’t enough – they also have a MythBusting page.  What is your favorite “fact” they are claiming?

Here are the current initial goals:

• Provide better application UI responsiveness
• Improve stability from slow rendering or crashes caused by content
• Improve performance, especially on multi-core machines

Now why do this, and what does it even mean?  Well, both Google Chrome and Internet Explorer 8 have moved in this direction for increased stability.  For an example, with multi-process support, a single tab crash wouldn’t take down your entire Firefox browsing experience.  It would only effect that one tab, because it would be seen as its own process. 

It might be a year or more before we see this in action via our own Firefox installations, however it is nice to see that Firefox is always looking to expand and check into other areas of stabilization to see if we can all benefit from it.

Here are some of the most popular plugins that help with increasing the privacy or security for your Firefox installation.

NoScript

The best security you can get in a web browser! Allow active content to run only from sites you trust, and protect yourself against XSS and Clickjacking attacks.

WOT

WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory.

Stealther

Do you like to pretend that you are a super secret spy when browing the Web? Maybe you just don’t want that nosy brother or sister looking in on what you have been doing. No matter the situation, if you want to stay secret – the Stealther Firefox extension is for you.

FoxyProxy

FoxyProxy is an advanced proxy management tool that completely replaces Firefox’s limited proxying capabilities. It offers more features than SwitchProxy, ProxyButton, QuickProxy, xyzproxy, ProxyTex, TorButton, etc.

Fire Encrypter

Want Firefox to help you encrypt your secret files and documents? Maybe you just want to learn more about the encryption process? No matter which camp you fall into, the Fire Encrypter Firefox extension is for you. It brings the top secret world of encryption right into your favorite little browser.

Sxipper

Forget your passwords! Sxipper accurately fills in forms, manages passwords and your OpenIDs.

CookieCuller

Want more control over your cookies? No, I’m not talking about the ones your grandmother loves to shove down your throat – I am talking about the ones that involve your browser. The Firefox extension CookieCuller gives you total control over which cookies stay on your computer by letting you protect cookies of your choice while automatically deleting the rest.

Flashblock

Flashblock is an extension for the Mozilla, Firefox, and Netscape browsers that takes a pessimistic approach to dealing with Macromedia Flash content on a webpage and blocks ALL Flash content from loading. It then leaves placeholders on the webpage that allow you to click to download and then view the Flash content.

TrackMeNot

With all this talk about your privacy being attacked and people snooping on what you have been searching about, you are bound to feel a little paranoid. You might be watching over your shoulder as you type. You might be turning the lights out before you get Online. How can you protect yourself from being tracked in your searches though? If you use Firefox, you need the TrackMeNot extension.

BugMeNot

Tired of web sites asking you to register to view the content inside?  Bypass compulsory web registration with the context menu via bugmenot.com.

Know of another Firefox security add-on that is well worth using, just not that popular yet?  Do any of these add-ons make you sleep a little easier at night?  Let me know what you think the best security add-on for Firefox is.

A of noise has been made about the excitement around private browsing.  Personally, this isn’t the feature I have been waiting for years to see, but it is nice to see Firefox keeping up with the competition and adding this feature in.  With this new mode (coming to Firefox 3.1) your browsing, cookies, temporary files, search, forms, and download history will not be saved.

Best thing about it that I have seen is that they will not interrupt the interface with some big bold “Hey you, you are browsing privately now” graphic.  You just get the simple (Private Browsing) in the title bar.

So are you excited to see private surfing added to Firefox or is this one of those “ehh, I guess it is ok” features for you too? Learn more about it at ehsanakhgari.org.