[Cialug] Firefox for paranoid people

[Josh More]

Hmm.

Perspectives looks very interesting, but hasn't been updated to the current Firefox, so I can't play with it.  (Same with Cert Alert.)

Chungwa is Taiwanese.

The CNNIC is an interesting idea.  I'm going to play with that.



-Josh More, CISSP, GIAC-GSLC, GIAC-GCIH, RHCE, NCLP
morej at alliancetechnologies.net
515-245-7701

________________________________________
From: cialug-bounces at cialug.org [cialug-bounces at cialug.org] on behalf of Matt Stanton [inflatablesoulmate at brothersofchaos.com]
Sent: Sunday, April 25, 2010 14:31
To: Central Iowa Linux Users Group
Subject: Re: [Cialug] Firefox for paranoid people

I can think of a couple of things you might be interested in, from a
paranoid browser standpoint...  First, the latest firefox (3.6.x) has a
new certificate authority that is controlled by the chinese government.
I disable its ability to identify anything whatsoever.  The CA is for
CNNIC (I also disable Chunghwa, simply because it looks chinese).
Deleting the certs does you no good, since FF will just re-add them.

Second, there is a browser add-on called 'perspectives', which adds
another layer of security for people who actually pay attention to
browser warnings.  The perspectives network has a list of sites and
their certificates, and checks the certificates/sites on a regular basis
from several discreet network locations to make sure that they all come
back the same to each location, and they come back the same each time it
checks.  It will pop up a warning if different locations come back with
different information, or if the information has changed recently.  I am
no security expert, but I believe this gives you a best-guess that a
site is not being hijacked by a man-in-the-middle attack, or that a
large-scale attack has changed the authority of the site internet-wide.
While both are probably extremely rare, it would identify a rogue CA if
you paid attention.

On 4/25/2010 2:04 PM, Josh More wrote:
> Since this has been a popular project in the past, and I just spent the weekend building myself a new laptop, I thought I'd share my firefox config with everyone.
>
> I started with my basic add ons:
> * Adblock Plus to prevent those annoying ads (and ad-based malware infections)
> * Neo Diggler to give me a quick way to clear the location bar and give me the ability to add custom stuff
> * No Script to prevent scripts from running.  I did a quick whitelisting of the sites I use a lot (Google, Amazon, Alliance, LinkedIn, etc)
> * Web of Trust to give me a hint before I click on a link.
> * Tiny Menu to maximize screen real estate.  (I love me the tiny laptops)
> * TorButton for quickly accessing The Onion Router (requires installing additional software to utilize)
>
> Sadly, LongURL is not supported on the new Firefox yet.
>
> I restarted Firefox to activate everything and configured the plugins the way I like.  I also customized the Nav bar and moved everything up to the Menu bar that TinyMenu made nice and small.  Then I used the View menu to turn off Navigation and Bookmarks.
>
> Then I went into Preferences->Privacy and set Firefox to "Never remember history" and suggest "Nothing".  I also cleared my history that was created thus far.  In Preferences->Security, I told it to never remember passwords, block reported attack sites, web forgeries and add ons.  (By not remembering passwords, I render myself less vulnerable to risk from theft of my profile directories, but more vulnerable to keyloggers... it's a good tradeoff to me.)
>
> I then shutdown Firefox and went into ~/.mozilla/firefox.  I did a cp -a of my profile directory to other names:
>
> cd ~/.mozilla/firefox
> cp -a blahblah.default research
> cp -a blahblah.default secure
> cp -a blahblah.default webdev
>
> Then I edited profiles.ini and copied the four top lines of [Profile0] to new blocks of Profiles 1 through 3.  I edited the Name and Path to reflect each of my new profile directories (research, secure, webdev).  Then I edited the FIrefox launcher and appended "-ProfileManager" to the "run command".  This way, when I click on the little icon, Firefox will prompt me for the profile I want each time I launch it.
>
> I then launched it and selected my "research" profile.
>
> Here, I went back into Preferences->Privacy and told it to go ahead and remember history and make suggestions (as when I'm researching things, I often forget where I found things and what I searched on.)  Then I installed the following add ons:
>
> * Add N Edit Cookies for cookie manipulations
> * HackBar for SQL injection fun
> * PassiveRecon for exactly what it sounds like
> * RefControl for mangling HTTP headers
>
> Then I added the following search engines to the dropbox:
>
> * Offensive Security Exploit Database
> * Security Focus Vulns Search
> * Security Wire Search
>
> I'll probably add more as I play with it.  I'm still not used to using this feature to search the deep web.  (Wonder if one could be written to access our corporate wiki?)
>
>
> Then it was time to restart Firefox and activate, set preferences, yada yada yada.
>
> After that, I restarted to access the "secure" profile.  Really, I should have named this one "paranoid".  I went into Preferences->Security and turned on ALL warning messages.  It's annoying to use now, but that's partly the point.
>
> I set StartPage to my initial home page, using the "Generate Custom URL" feature on the site.  Since I'm not storing any cookies at all, this is how it has to be done.  I removed all search engines and added IxQuick HTTPS, Startpage HTTPS and Scroogle SSL.   On the AddOn side, I added Force-TLS, though it really doesn't do all I'd like it to.
>
> Lastly, I installed the Orange Fox theme, which is ugly and garish, but since I wanted a visual reminder that I was in the paranoid profile, it was exactly what I wanted.
>
>
> After another restart I entered the webdev side.  The fun new add ons here were:
>
> * Firebug for tracing DOM and CSS issues, which I don't do much anymore, but it's still nice to have.
> * FlashGot for massive download fun on archive.org
> * Greasemonkey for fixing stupid sites (and integrating with FlashGot to bypass trivial Javascript-implemented "security" checks)
> * Live HTTP Headers for watching traffic in real time, when I don't want to launch a real proxy
> * Web Developer for the same reason as Firebug
>
>
> So, can any of you think of anything that I missed?
>
>
>
> -Josh More, CISSP, GIAC-GSLC, GIAC-GCIH, RHCE, NCLP
> morej at alliancetechnologies.net
> 515-245-7701
> _______________________________________________
> Cialug mailing list
> Cialug at cialug.org
> http://cialug.org/mailman/listinfo/cialug
>

_______________________________________________
Cialug mailing list
Cialug at cialug.org
http://cialug.org/mailman/listinfo/cialug