Risk
3/21/2012
02:22 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

Firefox Takes Privacy Lead With HTTPS By Default

Firefox users soon won't have to worry about their browsers betraying their search queries.

Securing The Super Bowls Of Sports
Securing The Super Bowls Of Sports
(click image for larger view and for slideshow)
Mozilla has fixed a Firefox "bug" that allowed information about users' searches to be easily observed.

The "bug," reported to Mozilla by privacy researcher Christopher Soghoian over a year ago, is in fact a feature: Web browsers rely on unprotected HTTP connections for Web search, thereby allowing anyone with access to Deep Packet Inspection tools, like ISPs or governments, to monitor and censor search data.

In addition, Web browsers using HTTP connections leak search queries through the "referrer header"--the keywords entered as search queries are transmitted to the destination website when a link returned in a search results list is clicked. Websites receiving search traffic happily collect this information because it's valuable for marketers to know the search terms that brought visitors to their sites.

[ Read HP Combines PC, Printer Groups. ]

Having begun tests of HTTPS search in 2010, Google last October said it would relay search queries over encrypted HTTPS connections for all signed-in users. In so doing, the company is shielding Internet packets from prying eyes and preventing the transmission of search query keywords to websites. But the percentage of Google searches conducted by signed-in users remains quite small: Google engineer Matt Cutts has suggested that less than 10% of Google searches come from those signed-in to their Google Accounts.

Mozilla has gone a step further, enabling HTTPS by default in Firefox, thereby making privacy protection available to all users of its browser.

"We are currently testing the change to use SSL for built-in Google searches in our Firefox nightly channel," a Mozilla spokesperson said via email. "If no issues are uncovered, it will move through our Aurora and Beta release channels before eventually shipping to all our Firefox users. This will include migrating the changes to our non-English version of Firefox, as well."

So it may be a few months before the average Firefox user sees this change, which the Electronic Frontier Foundation has been trying to encourage through its HTTPS Everywhere campaign.

"This is a big deal for the 25% or so of Internet users who use Firefox to browse the Web, bringing major improvements in privacy and security," Soghoian wrote in a blog post on Wednesday.

Soghoian, incidentally, filed a complaint with the Federal Trade Commission against Google in 2010 for claiming to support privacy but failing to take action to prevent browsers from leaking search queries, which Google has acknowledged may reveal personal information.

Soghoian credits Google with supporting Mozilla's decision to implement HTTPS by default--Google has a search deal with Mozilla and will end up processing the more resource-intensive encrypted traffic--but questions why Google's Chrome engineers have allowed themselves to be beaten to the punch.

"For the Chrome team, whose browser has otherwise set the gold standard for security (and who have proposed and implemented a mechanism to enable websites to limit referrer leakage), this must be extremely frustrating and probably quite embarrassing," he wrote. "Hopefully, they will soon follow Mozilla's lead by protecting their users with HTTPS search by default."

Google did not immediately respond to a request for comment.

Secure Sockets Layer isn't perfect, but there are ways to optimize it. The new Web Encryption That Works supplement from Dark Reading shows four places to start. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Bprince
50%
50%
Bprince,
User Rank: Ninja
3/22/2012 | 12:26:12 AM
re: Firefox Takes Privacy Lead With HTTPS By Default
Tech savvy users will care about this, but I doubt many people will know the difference, which I suspect is one of the reasons other browser vendors haven't done it.
Brian Prince, InformationWeek/Dark Reading Comment Moderator
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2037
Published: 2014-11-26
Openswan 2.6.40 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon restart) via IKEv2 packets that lack expected payloads. NOTE: this vulnerability exists because of an incomplete fix for CVE 2013-6466.

CVE-2014-6609
Published: 2014-11-26
The res_pjsip_pubsub module in Asterisk Open Source 12.x before 12.5.1 allows remote authenticated users to cause a denial of service (crash) via crafted headers in a SIP SUBSCRIBE request for an event package.

CVE-2014-6610
Published: 2014-11-26
Asterisk Open Source 11.x before 11.12.1 and 12.x before 12.5.1 and Certified Asterisk 11.6 before 11.6-cert6, when using the res_fax_spandsp module, allows remote authenticated users to cause a denial of service (crash) via an out of call message, which is not properly handled in the ReceiveFax dia...

CVE-2014-7141
Published: 2014-11-26
The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and crash) via a crafted type in an (1) ICMP or (2) ICMP6 packet.

CVE-2014-7142
Published: 2014-11-26
The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (crash) via a crafted (1) ICMP or (2) ICMP6 packet size.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?