Firefox Community Forum

I recently encountered an issue when attempting to login to The Coventry Building Society website using Firefox (desktop PC & Windows 10):- https://www.coventrybuildingsociety.co.uk/ It failed to display the page used to enter the one time passcode used for two factor authentication.

After looking on some forums I discovered this is because 'Strict' tracking protection was enabled. If I change to 'Custom' and uncheck 'Tracking Content' then things work as expected.

I also read on a forum that you can leave tracking protection set to 'Strict' but enter the URL for the problem website under 'Enhanced Tracking Protection -> Manage Exceptions'. I tried entering 'https://www.coventrybuildingsociety.co.uk/' Initially this appeared to work. However, when I tried it again the following day, the page failed to load as before. I had to change back from 'Strict' to 'Custom' and uncheck 'Tracking Content' once again. It's as if the exception URL is ignored in 'Strict' mode.

Am I doing something wrong or is this how it is supposed to work? Do I need to click on the shield icon (to the left of the padlock icon) and turn off 'Enhanced Tracking Protection' every time I visit the website?

Hello,

I have been testing all browsers I use (Firefox, Chrome, Edge) on Cloudflare Post-Quantum Key Agreement to verify PQC support. They all support the X25519MLKEM768 hybrid scheme (i.e. Cloudflare web page returns "You are using X25519MLKEM768 which is post-quantum secure").

The issue: When I run the test in Firefox multiple times by doing repeated hard refreshes (Ctrl+Shift+R), quite often the result is "You are using X25519 which is not post-quantum secure". Sometimes the very first run after opening Firefox gives the X25519 (failing) result. "Often" varies. Sometimes it's around 10 fails out of 50 tests, other times it's 1 out of 50. It seems random.

I have read that sometimes networking equipment or even ISPs can be the cause of PQC requests falling back to non-PQC due to the long keys in PQC, but I do not see this intermittent issue with Chrome or Edge on the same computer/network/ISP as Firefox. I have not seen a single failure so far on those two browsers. The only variable I am aware of is the web browser.

I also tried connecting to a cellular hotspot as well as disabling my Norton 360 firewall and the results are the same as above.

Looking for help to resolve this issue. Thanks.

Hello,

I just did a full windows defender scan and it turns out Trojan:Script/Wacatac.H!ml popped up when it was done and it said the files affected were:

containerfile: C:\Users\User\AppData\Local\Mozilla\Firefox\Profiles\.default-release\cache2\entries\InsertHashHere

file: C:\Users\User\AppData\Local\Mozilla\Firefox\Profiles\.default-release\cache2\entries\InsertHashHere->(GZip)

I removed the hashes or whatever they were behind the entries, I was wondering if this was a false positive? I didn't notice any slowed down or hacked accounts, also windows defender quarantined it. I've also reinstalled Firefox and deleted all folders associated with Mozilla in AppData.

For the past few days almost every site I try to visit gets the error:

Secure Connection Failed An error occurred during a connection to.... SSL received a record that exceeded the maximum permissible length. Error code: SSL_ERROR_RX_RECORD_TOO_LONG

this has happened on and off in the past for one or two sites but usually fixes itself within a day or less but this time it's been days. I tried everything I've seen online: -Try without add ons, - I am using 'system settings' proxy, -Followed an 8-yr-old suggestion of switching security.tls.version.max from 4 to 3 -My AV doesn't have HTTPS scanning that I can disable -It doesn't allow me to toggle the 'enhanced tracking is on' in the address bar -I've tried adding a site as an exception to DNS over HTTPS and turning Enable DNS over HTTPS off

Nothing has helped. These are all sites I've used in the past. I am using Nightly v150 at the moment but obviously same situation with FF or R3dfox.

If anyone can suggest how to bypass this so I don't have to use Edge/Chrome/Supermium (which all display these sites without issue) I'd appreciate it so much!

(*I'm looking for help with THIS issue on a W7 laptop, not about whether I should upgrade the OS.)

Thanks.

Trying to enable NextDNS for DNS over HTTP but it shows as not active (TRR_PARENTAL_CONTROL). I do not have any parental controls enabled on this device so im not sure whats causing this isssue.

I used Chrome until two days ago. I just got tired with how shitty the browser was, how bloated it made my computer, and how much Google treats everyone like a data product. However, I use hella google systems from Voice to Chrome to Drive to more and it all worked great together. Choosing to change to Firefox wasn't an easy decision but I knew it was a good one

Which makes it super irritating that some of the functionality is already facing problems. I have shortcuts I built to make it easier to study or do random things so I don't get distracted or tired. One shortcut is clicking a key that should launch UWorld in my default browser & use Lastpass to autologin (I couldn't get it to launch the service but that was a separate issue).

I check if autologin was on for the password on LastPass I've allowed all permissions to the LastPass extension I clear my cookies on UWorld & turned off enhanced tracking protection for the UWorld login portal site

What should I do to fix my one button shortcut again?

I really don't want to go randomly turning off every protection that Firefox gives me to figure it out so I'd appreciate someone who understands the browser better helping me out. Also, bonus points if you can help me build a single shortcut button on my Mac that can launch UWorld & navigate me straight to the question bank. (I do think the issue with autologin on LastPass is going to become more of an issue as I start opening up more websites I used to use on Chrome so I'd rather nip it in the bud before I see the problem occur more often)

Warning: Potential Security Risk Ahead

Firefox detected an issue and did not continue to www.txdrivingschool.org. The website is either misconfigured or your computer clock is set to the wrong time.

It’s likely the website’s certificate is expired, which prevents Firefox from connecting securely. If you visit this site, attackers could try to steal information like your passwords, emails, or credit card details.

What can you do about it?

The issue is most likely with the website, and there is nothing you can do to resolve it. You can notify the website’s administrator about the problem.

Learn more…

Hello community, I'm an embedded systems developer and we have a ressource constraint IOT device which is using TLS1.2. When we use https:// to access the internal website of the device, Firefox does a complete TLS handshake for each asset to download which renders https:// almost unusable. This happens despite session resumption using session IDs is offered by the device. When accessing the device with Chrome or Edge there's only one handshake and all the following TLS sessions are resumed with the ID of the first handshake. In Firefox security.ssl.disable_session_identifiers is set to false.

Is it intended behaviour that Firefox ignores session IDs for TLS1.2?

Used Firefox version: 142.0 (64-Bit) Windows 11

Thanks in advance.

Johannes

I was reading about CSS custom variables at https://developer.mozilla.org/en-US/docs/Web/CSS/CSS_cascading_variables/Using_CSS_custom_properties, and noticed that the example at "Using @property to control inheritance" does not work as described in the latest Firefox (115.21.0esr, 64-bit. on Windows laptop).

More specifically, both the parent and child divs come our in green, but the child div is supposed to come out in cornflowerblue.

Although it is not affecting me yet (I haven't decided whether to use this particular CSS feature), I was wondering if the issue was known.

Dear Mozilla Team,

I kindly ask you to add support for the X25519MLKEM768 hybrid post-quantum key exchange to the domain detectportal.firefox.com (the URL used by Firefox connection testing). This small change would significantly strengthen privacy protection for millions of users who rely on Firefox's connection test URL. As you know, this mechanism has already been successfully implemented on almost all of your other domains. Extending the same protection to detectportal.firefox.com would ensure consistency and close the remaining gap. Thank you very much for your ongoing work on privacy and post-quantum cryptography. I would greatly appreciate your attention to this request. Best regards, Anonymous

Secure Connection Failed

An error occurred during a connection to www.mofa.gov.sa. Cannot communicate securely with peer: no common encryption algorithm(s).

Error code: SSL_ERROR_NO_CYPHER_OVERLAP

   The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
   Please contact the website owners to inform them of this problem.

Learn more…

Secure Connection Failed

An error occurred during a connection to chatgpt.com. Cannot communicate securely with peer: no common encryption algorithm(s).

Error code: SSL_ERROR_NO_CYPHER_OVERLAP

   The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
   Please contact the website owners to inform them of this problem.

Learn more… this is what it says when i try to access

when i typing the address ofsite for connected to site of Iran goverment show a massage that your conection is not protect .what cause for send this massage .

Hello to all,

I wanted to use DoH (dnsforge.de) under “maximum protection”, but with one exception: I would like Ecosia.org to be able to place ads for me, because I am convinced of Ecosia and want to support this project. Tested this with Cloudflare as well, setting up an exception here does not work either.

Now the exception set in Firefox has no effect. It should not be due to the DNS provider, because Ecosia.org is not blocked and has even been whitelisted.

What is the expected behavior of the “maximum protection” setting?

Kind regards

Using FF 140.10.1 esr on a windows pc I noticed (probably long after the fact and numerous updates) that there's no longer https:// in the address bar. Having some recent issues with security made me look for this.

When I switched to Edge, the https:// was in the adddresses I was using. There is a lock symbol, but the locks seem to change in their appearance from one browser or website to the next.

Was this verification sign removed and, if so, why?  

Thank you.