Follow Us

We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message

Firefox to force secure connections for selected domains

Forcing secured connections protects the privacy and security of users and their data, Mozilla said

Article comments

Mozilla has introduced a pre-loaded list of domains for Firefox that can only be connected to securely in order to help protect the privacy and security of users.

To force secure connections between the browser and a server, Mozilla uses HSTS (HTTP Strict Transport Security), a mechanism used by servers to indicate that the connecting browser must use a secure connection, Mozilla's David Keeler said.

When the browser connects to an HSTS server for the first time though, the browser does not know if it should use a secure connection because it never received a HSTS header from that host. "Consequently, an active network attacker could prevent the browser from ever connecting securely (and even worse, the user may never realise something is amiss)", Keeler said, adding that setting up the connection that way still leaves it vulnerable to attacks.

As a workaround for that problem, Mozilla has added a list to Firefox with domains that the browser should only connect to securely by default.

"When a user connects to one of these hosts for the first time, the browser will know that it must use a secure connection. If a network attacker prevents secure connections to the server, the browser will not attempt to connect over an insecure protocol, thus maintaining the user's security," Keeler said.

The list has been seeded by domains from Chrome's HSTS preloaded list, that has a similar function to Mozilla's. Google's Chrome forces a secure connection for all google.com subdomains but also added forced HTTPS connections for sites that have requested it. Secure connections are forced for sites such as paypal.com, twitter.com, lastpass.com and torproject.org.

"HSTS in combination with a preloaded list of sites can be a great tool for increasing the security of users," Keeler wrote. The feature is currently only present in Firefox Beta.



Share:

More from Techworld

More relevant IT news

Comments



Send to a friend

Email this article to a friend or colleague:

PLEASE NOTE: Your name is used only to let the recipient know who sent the story, and in case of transmission error. Both your name and the recipient's name and address will not be used for any other purpose.

Techworld White Papers

Choose – and Choose Wisely – the Right MSP for Your SMB

End users need a technology partner that provides transparency, enables productivity, delivers...

Download Whitepaper

10 Effective Habits of Indispensable IT Departments

It’s no secret that responsibilities are growing while budgets continue to shrink. Download this...

Download Whitepaper

Gartner Magic Quadrant for Enterprise Information Archiving

Enterprise information archiving is contributing to organisational needs for e-discovery and...

Download Whitepaper

Advancing the state of virtualised backups

Dell Software’s vRanger is a veteran of the virtualisation specific backup market. It was the...

Download Whitepaper

Techworld UK - Technology - Business

Innovation, productivity, agility and profit

Watch this on demand webinar which explores IT innovation, managed print services and business agility.

Techworld Mobile Site

Access Techworld's content on the move

Get the latest news, product reviews and downloads on your mobile device with Techworld's mobile site.

Find out more...

From Wow to How : Making mobile and cloud work for you

On demand Biztech Briefing - Learn how to effectively deliver mobile work styles and cloud services together.

Watch now...

Site Map

* *