Showing questions tagged:

Add-In Permissions

One of the add-in permissions is "Access your data for sites in the “named” domain". I looked at that and thought, "That certainly cannot include passwords"; BUT the exp… (மேலும் படிக்க)

One of the add-in permissions is "Access your data for sites in the “named” domain". I looked at that and thought, "That certainly cannot include passwords"; BUT the explanation for this permission is: "The extension could read the content of web pages you visit in the specified domain, as well as data you enter into those web pages, such as usernames and passwords. "

I was stunned.

That means that addins that get this permission have access to my banking/medical/etc. usernames & passwords. This is not acceptable. Can a permission be developed that would be: "Access your data for sites in the “named” domain" (except usernames/passwords).

The permission "Access your data for all websites" is significantly worse in that it applies to all sites.

Archived 2 439

How do I disable passkey support?

I don't want to use passkeys, and it seems that every site is checking browser support and wasting my time with passkey prompts before allowing me to log in with a passwo… (மேலும் படிக்க)

I don't want to use passkeys, and it seems that every site is checking browser support and wasting my time with passkey prompts before allowing me to log in with a password. How do I disable passkey support in Firefox?

Archived 5 390

Firefox Sandbox implications of User Namespaces being disabled

One of the typical configuration in linux is to turn off the user namespaces and/or network namespaces. This is because most of the exploits in linux have been related to… (மேலும் படிக்க)

One of the typical configuration in linux is to turn off the user namespaces and/or network namespaces. This is because most of the exploits in linux have been related to namespaces vulnerabilities.

If there is a Firefox ver 127.0.2, running on Linux in which the user namespace is turned off then the following is observed in the Troubleshooting information, i.e. about:support Seccomp-BPF (System Call Filtering) true Seccomp Thread Synchronisation true User Namespaces for privileged processes true User Namespaces false Content Process Sandboxing true Media Plugin Sandboxing true

So how come with the username turned off, the content process and media plugin is still sandboxed? Also is having user namespace turned off, as given above, a security risk?

However if the network namespace is turned off, i.e. max_net_namespaces is set to zero, then it renders the browser unusable. Nothing works. Why is that?

Is there some documentation somewhere where these namespaces and their impact is explained in detail?

Archived 2 310