Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

4/13/2012
02:12 PM
Connect Directly
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Firefox To Require Permission For Plug-Ins

Mozilla hopes to make Firefox more secure by having users opt in for plug-ins.

Mozilla engineers are in the process of improving the security and speed of Firefox by implementing a permission switch for browser plug-ins.

In a blog post on Wednesday, Mozilla software engineer Jared Wein said that browser plug-ins are often the cause of security problems and system slowdowns and that "click-to-play" code has been added to Firefox nightly developer builds to control the activation of plug-ins.

"When plugins.click_to_play is enabled, plug-ins will require an extra click to activate and start 'playing' content," Wein explains. "This is an incremental step towards securing our users, reducing memory usage, and opening up the Web."

[ Read about Amazon's cloud-based search service. See Amazon Returns To Search Business With CloudSearch. ]

It may also further erode the usage of plug-in technologies such as Adobe Flash on desktop computers. In a Twitter post, privacy researcher Christopher Soghoian notes that the move "essentially kills Flash ads and Flash cookie tracking."

The impact of this new Firefox feature will depend on how it is expressed in default settings and on the various use cases that Firefox engineers end up supporting. For example, the click-to-play feature may include options to allow users to avoid having to reauthorize plug-ins on popular sites like YouTube. Mozilla does not want to make Firefox so secure it's a hassle to use. However, such conveniences could undermine potential security and privacy benefits of requiring users to approve plug-in operation.

Google Chrome has for a while now included a similar permission mechanism for plug-ins, accessed via Settings/Under the Hood/Privacy-Content Settings/Plug-ins. But Chrome's engineers evidently believe that users will have a better experience without having to approve plug-ins: "Run automatically" is singled out as the "recommended" option.

Mozilla is also considering whether to let previously granted plug-in approval expire if the plug-in has not been used in the past 30 days.

Apple recently adopted this expiration date approach to deal with the Flashback trojan that has affected over 600,000 Macs. In its security update released on Thursday, Apple said, "As a security hardening measure, the Java browser plug-in and Java Web Start are deactivated if they are unused for 35 days."

"Click-to-play" for plug-ins is scheduled to arrive in Firefox 14.

When picking endpoint protection software, step one is to ask users what they think. Also in the new, all-digital Security Software: Listen Up! issue of InformationWeek: CIO Chad Fulgham gives us an exclusive look at the agency's new case management system, Sentinel; and a look at how LTE changes mobility. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Bprince
50%
50%
Bprince,
User Rank: Ninja
4/14/2012 | 2:22:32 PM
re: Firefox To Require Permission For Plug-Ins
@readers: do you think this will have a positive impact on plugin security, and do you see it hurting the use of plugins overall?
Brian Prince, InformationWeek/Dark Reading Comment Moderator
News
Former CISA Director Chris Krebs Discusses Risk Management & Threat Intel
Kelly Sheridan, Staff Editor, Dark Reading,  2/23/2021
Edge-DRsplash-10-edge-articles
Security + Fraud Protection: Your One-Two Punch Against Cyberattacks
Joshua Goldfarb, Director of Product Management at F5,  2/23/2021
News
Cybercrime Groups More Prolific, Focus on Healthcare in 2020
Robert Lemos, Contributing Writer,  2/22/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Building the SOC of the Future
Building the SOC of the Future
Digital transformation, cloud-focused attacks, and a worldwide pandemic. The past year has changed the way business works and the way security teams operate. There is no going back.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-27132
PUBLISHED: 2021-02-27
SerComm AG Combo VD625 AGSOT_2.1.0 devices allow CRLF injection (for HTTP header injection) in the download function via the Content-Disposition header.
CVE-2021-25284
PUBLISHED: 2021-02-27
An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials to the info or error log level.
CVE-2021-3144
PUBLISHED: 2021-02-27
In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.)
CVE-2021-3148
PUBLISHED: 2021-02-27
An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can result in salt.utils.thin.gen_thin() command injection because of different handling of single versus double quotes. This is related to salt/utils/thin.py.
CVE-2021-3151
PUBLISHED: 2021-02-27
i-doit before 1.16.0 is affected by Stored Cross-Site Scripting (XSS) issues that could allow remote authenticated attackers to inject arbitrary web script or HTML via C__MONITORING__CONFIG__TITLE, SM2__C__MONITORING__CONFIG__TITLE, C__MONITORING__CONFIG__PATH, SM2__C__MONITORING__CONFIG__PATH, C__M...