Firefox Desktop Version 157 TLS key logging warning — Norton 360 Standard is suspected, but HTTPS scanning tests did not resolve it and so I need help with identifying the root casues and sepcifc steps to eliminate this warning

First things first. The error page is due to subresource or content framing security defined by either the inner or the outer document, most likely developer.mozilla.org/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/frame-ancestors — so that's an authoring choice, and ultimately an error on their side in nesting things, so that's not influenced by the scanning.

The scanning banner in displayed on error pages, but is not necessarily related to the error shown, or the reason for it. So seeing this through will have no effect on resolving the error attached — that's unrelated security policy configuration the site operators need to figure out.

(I'll skip the rest for now, as it's not apparent whether you wanna address the error state shown, or the TLS logging per se, since this is two unrelated things at this point.)

Firefox can't tell who is setting the logging, so you might need to liaise with Norton about this.

It's based on the env it's run with, I think it should be visible here: (potentially with a path that would shed some light on what tool set that based on the naming)

Is there any known Firefox 157 issue that could cause this warning to persist in these circumstances, or is the warning always evidence that TLS key logging is enabled in the Firefox process's environment?

I would appreciate a response based on Firefox's actual implementation rather than a general recommendation to check the Windows environment variables, as I have already done that.

Is there any known Firefox 157 issue that could cause this warning to persist

No.

in these circumstances

Which "these circumstances"?

is the warning always evidence that TLS key logging is enabled in the Firefox process's environment?

Yes.

I would appreciate a response based on Firefox's actual implementation rather than a general recommendation to check the Windows environment variables, as I have already done that.

Actual implementation: https://phabricator.services.mozilla.com/D308467 https://phabricator.services.mozilla.com/D301363 https://phabricator.services.mozilla.com/D222003 https://glam.telemetry.mozilla.org/fog/probe/sslkeylogging_enabled/explore?activeBuckets=%5B%22never%22%2C%22always%22%2C%22sometimes%22%5D&app_id=release&os=Windows

And your about:support Environment list above shows what exactly related to this?

Can someone in Mozilla from that thread (in the link you provided) explain what the observed path signifies and how its source can be identified reliably?

Valentin from Mozilla networking, author of most of the changes linked above, wrote the article Troubleshoot network errors when TLS key logging is enabled to answer these questions.

If that's not sufficient for you, consult the timeline of bugzilla.mozilla.org/1188660 and bugzilla.mozilla.org/1573172 where Daniel from Mozilla security starts the description with what the environment being set signifies and what risks are connected to it for mere consumers, not able to influence whether their security products restrict access to the resulting logs that are sensitive material.

If that's still not enough, please consult the general industry materials related to the functionality (it's for better part completely external to Firefox, besides its networking library NSS supporting the standard if directed so from the outside) as the actual capture you're apparently looking into is happening outside of Firefox:

https://wiki.wireshark.org/TLS https://everything.curl.dev/usingcurl/tls/sslkeylogfile.html https://www.ietf.org/archive/id/draft-thomson-tls-keylogfile-00.html

(Again, in the thread above I asked for the support profile that could include the path of the log file which could be telling to the actual party trying to decrypt it, but feel free to research that on your own; it will eventually just become off–topic here — you might wanna pursue that in Norton support forums though.)

I found this link while doing further research.

https://www.bleepingcomputer.com/forums/t/818202/so-the-back-button-link-in-browser-error-ff-154-with-tls-key-logging-is-enable/

Can a senior tech expert at Mozilla explain how to establish whether Norton is in fact injecting the SSLKeyLogFile variable into Firefox at process launch.

Might there be any other apps which could be doing that from what you know from your customers? Does Mozilla have a solution to fix this problem and if so pls share that with me and us as customers? Thanks

And the value of the variable in about:support is…?

Before sharing the environment variable's value, could you please explain why you need it and whether you mean the value of SSLKEYLOGFILE itself or the contents of the file it points to? I would prefer not to disclose any potentially sensitive information "publicly". I can confirm that I previously checked the Windows User and System environment variables and did not find an SSLKEYLOGFILE entry. If as senior official Mozilla Tech Support Engineer can communicate with me directly by e-mail that would be helpful. thank you

There's no "Mozilla Tech Support Engineer" — if you're looking for paid support, you might want to reach out to Norton directly if you're a customer of theirs.

I already have as a customer but they are totally useless and non-responsive.