What do you think about Mozilla Firefox weakening TLS security?
#browser#security#discuss#https
Simon Taddiken

Simon Taddiken @skuzzle

About: I've been a Java developer for more than 10 years. During this time I developped a strong sense for best practices and beneficial structures and patterns in software architecture.

Location:
Germany
Joined:
Oct 21, 2017

What do you think about Mozilla Firefox weakening TLS security?

Publish Date: Jul 2 '19
3 4

Mozilla Firefox is about to add an option (which is enabled by default!) that will make it easier for anti virus software to act as man in the middlle in order to decrypt and analyze encrypted HTTPS connections.

More information can be found in the mozilla knowledgebase.

I think this fundamentally subverts the whole purpose of TLS and trusted CAs. It is sad that browser manufacturers have to add security loopholes in order to gain acceptance of clueless users who expect higher security through running useless anti virus software.

Maybe there is a security expert around who can reasonable justify and explain this step?

Comments 4 total

  • Peter Cunha
    Peter CunhaJul 2, 2019

    All Firefox is doing is importing the CA's that are already stored within your Operating System.

    If you don't want a CA installed, you can simply remove it.

    It's not a violation of privacy.

  • Austin S. Hemmelgarn
    Austin S. HemmelgarnJul 2, 2019

    The security issue you seem to see is already present in a vast majority of software on most platforms. Firefox is actually a bit unusual in that it doesn't use the OS's trusted certificate store for TLS.

    The simple fact is that Firefox is bowing to how most people (both users and IT professionals) expect it to behave in the first place. Most users admittedly don't know that they expect it to work this way, but that doesn't change the fact that they do indeed expect this behavior.

  • Rémy 🤖
    Rémy 🤖Jul 3, 2019

    Maybe a move for Firefox to come back on market through the corporate route?

  • Mark Tse
    Mark TseJul 4, 2019

    On by default is concerning.

    It is a convenient feature though if off by default so I can easily do the import at work.

Add comment