Risk
3/21/2012
02:22 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

Firefox Takes Privacy Lead With HTTPS By Default

Firefox users soon won't have to worry about their browsers betraying their search queries.

Securing The Super Bowls Of Sports
Securing The Super Bowls Of Sports
(click image for larger view and for slideshow)
Mozilla has fixed a Firefox "bug" that allowed information about users' searches to be easily observed.

The "bug," reported to Mozilla by privacy researcher Christopher Soghoian over a year ago, is in fact a feature: Web browsers rely on unprotected HTTP connections for Web search, thereby allowing anyone with access to Deep Packet Inspection tools, like ISPs or governments, to monitor and censor search data.

In addition, Web browsers using HTTP connections leak search queries through the "referrer header"--the keywords entered as search queries are transmitted to the destination website when a link returned in a search results list is clicked. Websites receiving search traffic happily collect this information because it's valuable for marketers to know the search terms that brought visitors to their sites.

[ Read HP Combines PC, Printer Groups. ]

Having begun tests of HTTPS search in 2010, Google last October said it would relay search queries over encrypted HTTPS connections for all signed-in users. In so doing, the company is shielding Internet packets from prying eyes and preventing the transmission of search query keywords to websites. But the percentage of Google searches conducted by signed-in users remains quite small: Google engineer Matt Cutts has suggested that less than 10% of Google searches come from those signed-in to their Google Accounts.

Mozilla has gone a step further, enabling HTTPS by default in Firefox, thereby making privacy protection available to all users of its browser.

"We are currently testing the change to use SSL for built-in Google searches in our Firefox nightly channel," a Mozilla spokesperson said via email. "If no issues are uncovered, it will move through our Aurora and Beta release channels before eventually shipping to all our Firefox users. This will include migrating the changes to our non-English version of Firefox, as well."

So it may be a few months before the average Firefox user sees this change, which the Electronic Frontier Foundation has been trying to encourage through its HTTPS Everywhere campaign.

"This is a big deal for the 25% or so of Internet users who use Firefox to browse the Web, bringing major improvements in privacy and security," Soghoian wrote in a blog post on Wednesday.

Soghoian, incidentally, filed a complaint with the Federal Trade Commission against Google in 2010 for claiming to support privacy but failing to take action to prevent browsers from leaking search queries, which Google has acknowledged may reveal personal information.

Soghoian credits Google with supporting Mozilla's decision to implement HTTPS by default--Google has a search deal with Mozilla and will end up processing the more resource-intensive encrypted traffic--but questions why Google's Chrome engineers have allowed themselves to be beaten to the punch.

"For the Chrome team, whose browser has otherwise set the gold standard for security (and who have proposed and implemented a mechanism to enable websites to limit referrer leakage), this must be extremely frustrating and probably quite embarrassing," he wrote. "Hopefully, they will soon follow Mozilla's lead by protecting their users with HTTPS search by default."

Google did not immediately respond to a request for comment.

Secure Sockets Layer isn't perfect, but there are ways to optimize it. The new Web Encryption That Works supplement from Dark Reading shows four places to start. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Bprince
50%
50%
Bprince,
User Rank: Ninja
3/22/2012 | 12:26:12 AM
re: Firefox Takes Privacy Lead With HTTPS By Default
Tech savvy users will care about this, but I doubt many people will know the difference, which I suspect is one of the reasons other browser vendors haven't done it.
Brian Prince, InformationWeek/Dark Reading Comment Moderator
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Must Reads - September 25, 2014
Dark Reading's new Must Reads is a compendium of our best recent coverage of identity and access management. Learn about access control in the age of HTML5, how to improve authentication, why Active Directory is dead, and more.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2003-1598
Published: 2014-10-01
SQL injection vulnerability in log.header.php in WordPress 0.7 and earlier allows remote attackers to execute arbitrary SQL commands via the posts variable.

CVE-2011-4624
Published: 2014-10-01
Cross-site scripting (XSS) vulnerability in facebook.php in the GRAND FlAGallery plugin (flash-album-gallery) before 1.57 for WordPress allows remote attackers to inject arbitrary web script or HTML via the i parameter.

CVE-2012-0811
Published: 2014-10-01
Multiple SQL injection vulnerabilities in Postfix Admin (aka postfixadmin) before 2.3.5 allow remote authenticated users to execute arbitrary SQL commands via (1) the pw parameter to the pacrypt function, when mysql_encrypt is configured, or (2) unspecified vectors that are used in backup files gene...

CVE-2012-5485
Published: 2014-09-30
registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified vectors, related to the admin interface.

CVE-2012-5486
Published: 2014-09-30
ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Chris Hadnagy, who hosts the annual Social Engineering Capture the Flag Contest at DEF CON, will discuss the latest trends attackers are using.