Security Articles
-
Privacy policy guidelines and Template for web apps
Releasing an app is much more than just coding it. You are providing a service to people and they trust you with their data. With the amount of reports of apps “calling home” and storing and sending your data to third parties without your consent Read more…
-
An interesting way to determine if you are logged into social web sites
Do you remember the trick how to find out that you went to certain web sites by analysing link colour (now patched in Firefox)? There is much your browser tells about you if you just create a few HTML elements. Mike Cardwell has found an Read more…
-
ECMAScript 5 strict mode in Firefox 4
Editor’s note: This article is posted by Chris Heilmann but authored by Jeff Walden – credit where credit is due. Developers in the Mozilla community have made major improvements to the JavaScript engine in Firefox 4. We have devoted much effort to improving performance, but Read more…
-
WebSocket disabled in Firefox 4
Recent discoveries found that the protocol that Websocket works with is vulnerable to attacks. Adam Barth demonstrated some serious attacks against the protocol that could be used by an attacker to poison caches that sit in between the browser and the Internet. This is a Read more…
-
Firefox 4: HTTP Strict Transport Security (force HTTPS)
This article is about a new HTTPS header: Strict-Transport-Security, which force a website to be fetched through HTTPS. This feature will be part of Firefox 4. How do you type URLs? Do you prefix them with http:// or https:// systematically? Or do you just type Read more…
-
Account Manager coming to Firefox
Update: The Account Manager is no longer maintained. Building on this experiment, we have conceived BrowserID. Please consider using it instead. Last month Mozilla Labs announced a new concept series on online identity. As part of this exploration, we developed the Account Manager. The Account Read more…
-
mozilla developer preview 4 ready for testing
Note: this is a re-post of the entry in the Mozilla Project Development Weblog. There’s some juicy stuff in here for Web Developers that need testing. In particular, this is the first build with the CSS history changes. As part of our ongoing platform development Read more…
-
privacy-related changes coming to CSS :visited
For more information about this, have a look at David Baron’s post, the bug and the post on the security blog. For many years the CSS :visited selector has been a vector for querying a user’s history. It’s not particularly dangerous by itself, but when Read more…
-
mitigating attacks with content security policy
