Komunitné fórum Firefox

It seems to me that Firefox's DoH implementation is not just pointless but actually harmful. It is security theater. Let me explain:

• There is no fine-grained control
• There is no ability for the user to choose what level applies to what networks
• Default Protection provides no protection when there is a canary domain (trivial)
• Increased Protection provides no protection when the default provider fails (trivial)
• Max Protection requires manual intervention when the default provider fails
• Bonus: it's inconvenient or impossible to use on mobile

For DoH to be useful, the user has to invest effort they could better spend setting up a proper system-level solution.

Today I suddenly started receiving the error code: SEC_ERROR_REVOKED_CERTIFICATE on a secure authentication page that was working until a few hours earlier, belonging to a major national bank.

https://www.ssllabs.com/ssltest/ cannot reach that page, other SSL checking sites report variable results (some say one cert in the chain has expired after a CRL, others say all is OK)

The same page/site works flawlessly on Chrome. Firefox incompatibility with popular portals is a growing trend unfortunately.

After a little digging with developer tools, it comes out the OCSP query reports the REVOKED_CERTIFICATE error. Disabling the "Query OCSP [..]" option in Firefox that website starts working fine again.

Now, I would like to still keep using the OCSP queries ON, and I definitely want to keep using Firefox for everything.

My question is: when a portal or website is found to be broken with Firefox (with default settings), with a root cause found like in this case, how can it be reported?

Having a clear report path would be useful to try to make the browser more compatible (in this case : was this a bug? Some wrong information on OCSP responders? Some mess caused by the website mantainers?)

I was very excited to see in the 131.0.3 release notes that it fixed a problem with bill pay. I've been unable to use bill pay at my small local bank since v131. My bank was unable to help me and I couldn't get bill pay to work with v131 even after opening everything up as much as I knew how (cookies, trackers, etc.).

Sadly, v 131.0.3 still has the same behavior of blocking bill pay with a very similar message to the BOA message posted earlier.

My local bank uses a site named: web13.secureinternetbanking.com and in the past, I also needed to exempt cookies from sites named: cwsb40.checkfreeweb.com and cw411.checkfreeweb.com. I've also added these sites to the exceptions list for enhanced tracking without effect.

I found a thread on Mozilla Connect from ipv6_fan that seemed to indicate a solution.

Based on that thread, I checked the following parameters:

The value of network.cookie.cookieBehavior.optInPartitioning is false.

The value of network.cookie.CHIPS.enabled is true.

When I set network.cookie.CHIPS.enabled to false, my billpay popped up as usual.

This seems to indicate (to a novice like me) that there are still issues in 131.0.3 with partitioned cookies.

To make this point, yesterday I spent probably an hour and a 1/2 trying to get to another bank account on Barclays working again because they just "upgraded their web experience". I think I was able to get all the new URLs identified for my exception list for cookies, but blocking cross tracking also creates havoc and I had to turn it off to get the bank site to work. I tried to add sites to the exception list for cross tracking, but firefox still showed it was blocking trackers even though I had added it to the exception list - so I gave up after all that time.

I appreciate the additional security being built into Firefox, but it seems to not play well with banks who seem to be on their own path for increasing security. These two paths don't seem to be converging.

I hope this doesn't sound ungrateful. Thanks for working on this.

Hey all. Please help.

Periodically I delete my cookies and site data thus... Preferences/Privacy & Security/Cookies and Site Data/Clear Data. I used to use an add on for this but it stopped working.

Today it says I have "Temporary and cached files 1.3 MB". But it says that after Clear Data. It says it after I quit and restart Firefox. And I still says it after restart the computer. My Manage Data... and Manage Exceptions... boxes are empty. I have tried running Antivirus Zap Pro, which doesn't find anything sinister. How can I get rid of it... whatever it is? Can I access the folder and delete it manually?

I'm on an old Macbook Air, running Monterey. With the latest Firefox 132.0.2

Thanks in advance.

Dear Mozilla Firefox Team,

I hope this message finds you well.

I am writing to inquire about the removal of the following SSL/TLS certificates from Firefox's trusted certificate store. These certificates are identified by the following SHA1 fingerprints:

SHA1 Fingerprint: ff:bd:cd:e7:82:c8:43:5e:3c:6f:26:86:5c:ca:a8:3a:45:5b:c3:0a SHA1 Fingerprint: b8:be:6d:cb:56:f1:55:b9:63:d4:12:ca:4e:06:34:c7:94:b2:1c SHA1 Fingerprint: 58:d1:df:95:95:67:6b:63:c0:f0:5b:1c:17:4d:8b:84:0b:c8:78 SHA1 Fingerprint: e9:a8:5d:22:14:52:1c:5b:aa:0a:b4:be:24:6a:23:8a:c9:ba:e2 SHA1 Fingerprint: 8a:2f:af:57:53:b1:b0:e6:a1:04:ec:5b:6a:69:71:6d:f6:1c:e2:84 SHA1 Fingerprint: ae:c5:fb:3f:c8:e1:bf:c4:e5:4f:03:07:5a:9a:e8:00:b7:f7:b6 Could you kindly provide clarification as to why these specific certificates were removed? Understanding the rationale behind this decision will help us assess any potential impact on our systems and ensure that we are adhering to the best practices for security.

Thank you in advance for your attention to this matter. I look forward to your response.

Best regards, Vamsi [edited email from public]

I have been watching YouTube for years, issue free. This week I was blocked, as my computer may be blocking ads and thus violating You Tubes policy. How can I find and disable ad block programs/ extensions, thus allowing me to get back on You tube. I can recognize an outright program, but do not knew if extensions are in play that are not obvious to me. THANKS

As much as I hate ads on YouTube I don't want Firefox to block the ads because if they find out you are blocking ads they will block you from Google and YouTube. I have Google pages and other things on their sites that have been there for years. Plus, I feel like I'm stealing a service by not lets the ads run that pays their bills and the content creators on YouTube. Please tell me where in Firefox I can turn the ads back on.

I have used Mozilla products since Netscape Navigator came out in 1995 I think it was. I went to a local internet provider and brought home a 3.5in Diskette and it loaded Netscape Navigator with my info all filled in for email, Usenet, Webpage publishing and a few Bookmarks to get started. I still use SeaMonkey for my email because it still has email addresses from the 1990's. I have Thunderbird for email on my phone. Anyway, thank you for all your work over the years. Rocky, [redacted email from community support forum]

Kaiser has installed a 3rd Party cookie. "We may also place a persistent third-party cookie (provided by Google) on your hard drive if you sign on to kp.org."

The way to opt out is to go on the following website and opt out. However, only 3 out of the 51 companies could opt out on Firefox. It claims that the browser setting is prevent it from opting out. https://optout.networkadvertising.org/?c=1

I WAS ON A SITE AND IT BROUGHT UP THE COOKIE PAGE FOR FIREFOX TO PROTECT ME FROM PEOPLE OR COMPANIES FROM TRACKING MY BROWSING AND I COULD NOT GET BACK TO MY PURCHASE PAGE APP ACOOUNT I WAS ON. SO WHAT HAPPEN & WHY DID THIS COME UP?