Risk
3/21/2012
02:22 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Firefox Takes Privacy Lead With HTTPS By Default

Firefox users soon won't have to worry about their browsers betraying their search queries.

Securing The Super Bowls Of Sports
Securing The Super Bowls Of Sports
(click image for larger view and for slideshow)
Mozilla has fixed a Firefox "bug" that allowed information about users' searches to be easily observed.

The "bug," reported to Mozilla by privacy researcher Christopher Soghoian over a year ago, is in fact a feature: Web browsers rely on unprotected HTTP connections for Web search, thereby allowing anyone with access to Deep Packet Inspection tools, like ISPs or governments, to monitor and censor search data.

In addition, Web browsers using HTTP connections leak search queries through the "referrer header"--the keywords entered as search queries are transmitted to the destination website when a link returned in a search results list is clicked. Websites receiving search traffic happily collect this information because it's valuable for marketers to know the search terms that brought visitors to their sites.

[ Read HP Combines PC, Printer Groups. ]

Having begun tests of HTTPS search in 2010, Google last October said it would relay search queries over encrypted HTTPS connections for all signed-in users. In so doing, the company is shielding Internet packets from prying eyes and preventing the transmission of search query keywords to websites. But the percentage of Google searches conducted by signed-in users remains quite small: Google engineer Matt Cutts has suggested that less than 10% of Google searches come from those signed-in to their Google Accounts.

Mozilla has gone a step further, enabling HTTPS by default in Firefox, thereby making privacy protection available to all users of its browser.

"We are currently testing the change to use SSL for built-in Google searches in our Firefox nightly channel," a Mozilla spokesperson said via email. "If no issues are uncovered, it will move through our Aurora and Beta release channels before eventually shipping to all our Firefox users. This will include migrating the changes to our non-English version of Firefox, as well."

So it may be a few months before the average Firefox user sees this change, which the Electronic Frontier Foundation has been trying to encourage through its HTTPS Everywhere campaign.

"This is a big deal for the 25% or so of Internet users who use Firefox to browse the Web, bringing major improvements in privacy and security," Soghoian wrote in a blog post on Wednesday.

Soghoian, incidentally, filed a complaint with the Federal Trade Commission against Google in 2010 for claiming to support privacy but failing to take action to prevent browsers from leaking search queries, which Google has acknowledged may reveal personal information.

Soghoian credits Google with supporting Mozilla's decision to implement HTTPS by default--Google has a search deal with Mozilla and will end up processing the more resource-intensive encrypted traffic--but questions why Google's Chrome engineers have allowed themselves to be beaten to the punch.

"For the Chrome team, whose browser has otherwise set the gold standard for security (and who have proposed and implemented a mechanism to enable websites to limit referrer leakage), this must be extremely frustrating and probably quite embarrassing," he wrote. "Hopefully, they will soon follow Mozilla's lead by protecting their users with HTTPS search by default."

Google did not immediately respond to a request for comment.

Secure Sockets Layer isn't perfect, but there are ways to optimize it. The new Web Encryption That Works supplement from Dark Reading shows four places to start. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Bprince
50%
50%
Bprince,
User Rank: Ninja
3/22/2012 | 12:26:12 AM
re: Firefox Takes Privacy Lead With HTTPS By Default
Tech savvy users will care about this, but I doubt many people will know the difference, which I suspect is one of the reasons other browser vendors haven't done it.
Brian Prince, InformationWeek/Dark Reading Comment Moderator
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0993
Published: 2014-09-15
Buffer overflow in the Vcl.Graphics.TPicture.Bitmap implementation in the Visual Component Library (VCL) in Embarcadero Delphi XE6 20.0.15596.9843 and C++ Builder XE6 20.0.15596.9843 allows remote attackers to execute arbitrary code via a crafted BMP file.

CVE-2014-2375
Published: 2014-09-15
Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to read or write to arbitrary files, and obtain sensitive information or cause a denial of service (disk consumption), via the CSV export feature.

CVE-2014-2376
Published: 2014-09-15
SQL injection vulnerability in Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

CVE-2014-2377
Published: 2014-09-15
Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to discover full pathnames via an application tag.

CVE-2014-3077
Published: 2014-09-15
IBM SONAS and System Storage Storwize V7000 Unified (aka V7000U) 1.3.x and 1.4.x before 1.4.3.4 store the chkauth password in the audit log, which allows local users to obtain sensitive information by reading this log file.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
CISO Insider: An Interview with James Christiansen, Vice President, Information Risk Management, Office of the CISO, Accuvant