Slashdot Mirror
Firefox Will Soon Warn Users of Software That Performs MitM Attacks (zdnet.com)
The Firefox browser will soon come with a new security feature that will detect and then warn users when a third-party app is performing a Man-in-the-Middle (MitM) attack by hijacking the user's HTTPS traffic. From a report: The new feature is expected to land in Firefox 66, Firefox's current beta version, scheduled for an official release in mid-March. The way this feature works is to show a visual error page when, according to a Mozilla help page, "something on your system or network is intercepting your connection and injecting certificates in a way that is not trusted by Firefox." An error message that reads "MOZILLA_PKIX_ERROR_MITM_DETECTED" will be shown whenever something like the above happens.
Not sure how many corporate Firefox deployments there are but this could really give some IT support groups a headache.
On the bright side, users will learn quickly when Superfish style shenanigans are going on.
Overall, I like the idea. In practice, I am thinking this is going to cause more pain than pleasure....
My eyes reflect the stars and a smile lights up my face.
Would also be nice if Firefox would check/verify TLSA/DANE is a domain/site uses it. There was a plug-in (DNSSEC/TLSA Validator) that performed this task, but the developers gave up on Firefox back when the API changed.
The linked article has no technical details.
How does the browser know when the certificate isn't the "right" one? Presumably, the false certificate's root is installed as valid on the system. Will this warning come up any time a page is viewed that relies on a non-bundled root certificate?
How does an ISP inject certs? The whole point of SSL/TLS is to stop that. Is this some new attack vector? Why aren't we just patching the flaw in TLS?
if that "man" happens to be a 400 pound IT janitor, there isn't enough food in my fridge for both of us!
Screw MITM attacks by my employer. I want to know when Trump is colluding with Russians, or if it is easier, just tell me when he is NOT colluding with them.
Hillary 2020 is going to own his shit this time. Fucking Cheeto.
They're adding a feature to prevent a "Trusted Man-in-the-Middle" being setup by an application, or by your company.
I wish they would think about this a little more carefully.... This is likely to lead to Firefox being put back on many companies' "Banned Browser List"
https://support.mozilla.org/en-US/kb/error-codes-secure-websites?redirectlocale=en-US&redirectslug=troubleshoot-SEC_ERROR_UNKNOWN_ISSUER#w_kaspersky
The most common causes are security software scanning encrypted connections or malware listening in, replacing legitimate website certificates with their own. In particular, this is indicated by the error code "MOZILLA_PKIX_ERROR_MITM_DETECTED" if Firefox is able to detect that the connection is intercepted.
Third-party antivirus software can interfere with Firefox's secure connections. We recommend uninstalling your third-party software and using the security software offered for Windows by Microsoft:
I guess it didn't occur to the Firefox developers that one reason that users install 3rd party antivirus software is to check for, you know, MITM attacks on their https connections. So basically, now you have the browser's MITM attack detection of the anti-virus's MITM attack detection, which causes the annoying error message about a MITM attack to pop up. And Mozilla's solution to this annoyance? Get rid of your favorite antivirus product and just go with Microsoft's offerings. Yeah, no.
Have no fear, the Cybersecurity and Infrastructure Security Agency is here!
Using our amazing powers of bureaucratic ineptitude, we will distract everyone and suck more taxpayer money while performing "cybersecurity" theater, going on junkets to expensive places such as Rome, London, and Zurich, and constantly reorganizing.
The main problem with the entire X.509 system that I have, is that it just assumes everyone at the organization that makes your browser and where you get it from, is trustworthy.
What good is a certificate from an "authority" that I have never met in person, let alone got to know enough to decide if they are trustworthy?
What good is an "authority" just shoved down my throat by a browser maker that I have never met in person, let alone got to know enough to decide if the people there are trustworthy? (Or the devices that they use.)
What good is even a perfectly trustworthy browser maker who picks perfectly trustworthy CAs, if I download it over the outdated browser of my OS that I installed from a medium that was made with an outdated OS or on another computer, and so on, that all were never checked for trustworthiness?
Especially in a world of firmware with backdoors and crazy shit like dopant-level hardware trojans that you can't even detect with a microscope!
I have my own CA, and then the system makes sense, but what it's built on still makes it as pointless as WhatsApp's encryption between closed-source Facebook code (the client) and Facebook servers.
Am I supposed to just turn my brain off and assume that in that entire chain, there was not even a single dickhead with a big budget, who just wanted to spy on ALL the things? I've read the Snowden leaks and know about Five Eyes, China, Russia and Israel's efforts. Hell, I can do half that shit myself in my spare time!
We're bickering about utterly superficial pointless things. Who watches the watchmen? WE DO. In the very end, it is always oneself. And even that implies that we're competent in that in the first place.
ERROR 9001: EXISTENTIAL CRISIS. CONNECTION TERMINATED.
I have to take issue with the whole, "MOZILLA_PKIX_ERROR_MITM_DETECTED".
I mean, it's far from the worst error message I've ever seen, not that such a low bar should be the standard. It just seems like it's lacking. Majorly.
Does it seem to anyone else like this doesn't really call attention to the security nature of this problem? If I was an ordinary user, this looks exactly like something I don't want to see. It looks like any bog-standard buffer overflow message, like any divide by zero message, like any memory access error message.
Does the ordinary user know what Mozilla is? OK, that's not too hard. Do they know what a MITM is? Probably not. Hell, even I don't know what PKIX is! And it's in all caps and the spaces have been replaced by underscores.
So my concern is, the average user sees this as yet more technobabble. How do they respond to technobabble? Try to click on OK and keep doing exactly what they were doing before the error. Which is the opposite of what we want them to be doing.
All I want to know is how to get rid of the three extraneous bars which appear below the address bar when I start typing an address. First started in version shitty 65 (it was forced on me at work) and the documentation for it doesn't say what these bars are for.
We will bankrupt ourselves in the vain search for absolute security. -- Dwight D. Eisenhower
Look at that Interface - Evil Patterns EVERYWHERE.
[sarcasm] Well, at least they will use a clear warning message that the average joe would understand. [/sarcasm] PKIX 2ur MITM MKAY
there was a post about a M$ manager who was badmouthing Mozilla.
Mozilla/Firefox makes a product that I truly believe puts the user's interests first. This particular goal is an example of the philosophy. As long as Firefox does stuff like this, I don't care if it is 0.1% of the browser market, I will use it. F M$ and google and their browsers. I use intentionally use those companies' other services and products as little as possible and will continue to do so for as long as I can.
"To stop the terrorists."
... to a warning about a "Man in the Middle" issue will be to tell their son to stop standing in front of the WiFi. (sigh)
It must have been something you assimilated. . . .
As corporate IT I can tell you it's not about knowing where you go. We have easier ways to find that out. It's about protecting out employees and corporate information. We use MitM SSL inspection to pump data to our Intrusion detection system to block viruses and malware in transit. It is VERY effective, desktop Malware incidents were reduced 85% the day we started. It is also used to detect tunneling ransomware and fraudulent reverse proxied sites. Turn it 180 and we use it on our web servers to detect hacking inside SSL to protect those services also. We also use it for detecting SS#, account#, customer info, and company "secrets" being uploaded; usually unintentionally..
As long as the message was clear and accurate I would not have A problem but if it is a great big "YOU ARE NOT SAFE" nag screen we will probably drop Firefox internally and drop FF as a supported browser for our client facing web services because users will actually be LESS safe if we are not inspecting SSL for threats for them.
YES exactly TLSA/DANE is the answer here but sadly apart from national Security agencies...
if only mozilla actually built a browser around security...
TLSA/DANE effectively declares the TLS/SSL cert you should expect so you can use it even through a proxy