Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

4/13/2012
02:12 PM
Connect Directly
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Firefox To Require Permission For Plug-Ins

Mozilla hopes to make Firefox more secure by having users opt in for plug-ins.

Mozilla engineers are in the process of improving the security and speed of Firefox by implementing a permission switch for browser plug-ins.

In a blog post on Wednesday, Mozilla software engineer Jared Wein said that browser plug-ins are often the cause of security problems and system slowdowns and that "click-to-play" code has been added to Firefox nightly developer builds to control the activation of plug-ins.

"When plugins.click_to_play is enabled, plug-ins will require an extra click to activate and start 'playing' content," Wein explains. "This is an incremental step towards securing our users, reducing memory usage, and opening up the Web."

[ Read about Amazon's cloud-based search service. See Amazon Returns To Search Business With CloudSearch. ]

It may also further erode the usage of plug-in technologies such as Adobe Flash on desktop computers. In a Twitter post, privacy researcher Christopher Soghoian notes that the move "essentially kills Flash ads and Flash cookie tracking."

The impact of this new Firefox feature will depend on how it is expressed in default settings and on the various use cases that Firefox engineers end up supporting. For example, the click-to-play feature may include options to allow users to avoid having to reauthorize plug-ins on popular sites like YouTube. Mozilla does not want to make Firefox so secure it's a hassle to use. However, such conveniences could undermine potential security and privacy benefits of requiring users to approve plug-in operation.

Google Chrome has for a while now included a similar permission mechanism for plug-ins, accessed via Settings/Under the Hood/Privacy-Content Settings/Plug-ins. But Chrome's engineers evidently believe that users will have a better experience without having to approve plug-ins: "Run automatically" is singled out as the "recommended" option.

Mozilla is also considering whether to let previously granted plug-in approval expire if the plug-in has not been used in the past 30 days.

Apple recently adopted this expiration date approach to deal with the Flashback trojan that has affected over 600,000 Macs. In its security update released on Thursday, Apple said, "As a security hardening measure, the Java browser plug-in and Java Web Start are deactivated if they are unused for 35 days."

"Click-to-play" for plug-ins is scheduled to arrive in Firefox 14.

When picking endpoint protection software, step one is to ask users what they think. Also in the new, all-digital Security Software: Listen Up! issue of InformationWeek: CIO Chad Fulgham gives us an exclusive look at the agency's new case management system, Sentinel; and a look at how LTE changes mobility. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Bprince
50%
50%
Bprince,
User Rank: Ninja
4/14/2012 | 2:22:32 PM
re: Firefox To Require Permission For Plug-Ins
@readers: do you think this will have a positive impact on plugin security, and do you see it hurting the use of plugins overall?
Brian Prince, InformationWeek/Dark Reading Comment Moderator
Commentary
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
Edge-DRsplash-11-edge-ask-the-experts
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
News
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-32697
PUBLISHED: 2021-06-21
neos/forms is an open source framework to build web forms. By crafting a special `GET` request containing a valid form state, a form can be submitted without invoking any validators. Form state is secured with an HMAC that is still verified. That means that this issue can only be exploited if Form F...
CVE-2020-19510
PUBLISHED: 2021-06-21
Textpattern 4.7.3 contains an aribtrary file load via the file_insert function in include/txp_file.php.
CVE-2020-19511
PUBLISHED: 2021-06-21
Cross Site Scriptiong vulnerability in Typesetter 5.1 via the !1) className and !2) Description fields in index.php/Admin/Classes,
CVE-2021-21422
PUBLISHED: 2021-06-21
mongo-express is a web-based MongoDB admin interface, written with Node.js and express. 1: As mentioned in this issue: https://github.com/mongo-express/mongo-express/issues/577, when the content of a cell grows larger than supported size, clicking on a row will show full document unescaped, however ...
CVE-2021-0532
PUBLISHED: 2021-06-21
In memory management driver, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-185196177