• Please review our updated Terms and Rules here

Firefox Internet Security Issue

The browser executes foreign Javascript (or tries to), which may be injected through ads or other sources. Really old systems may be hit by domain squatting, where the original domain has come under new ownership. Fingerprinting allows malicious code to target specific systems, to stay largely undetected.

A NAT won't protect you if it is your browser issuing the request. If malicious code gets into your system, it can use STUN to facilitate direct connections between NAT systems, building botnets.

As soon as you assume being behind a NAT, only visiting perfectly secure and well-maintained websites, and browsers which never go anywhere else on their own, you are probably fine. Systems too old to be usable (such as DOS or early Windows machines or early Macintoshes) are also fine, as they fail to execute malicious code. Although the 16-bit versions of Internet Explorer and especially Outlook Express on Windows 3.1 were accidentally weaponized; their parsing and scripting engines were largely compatible with their 32-bit counterparts.
 
Zare said:
Wait but reaching is impossible due to NAT. Unless you allow the router to be configured by OS via upnp which I think is bollocks.
Click to expand...

Reaching out and touching a NAT client is not impossible. There have been exploits for decades that can compromise devices behind NAT, and more are being discovered all the time.

One example: https://arxiv.org/html/2404.04601v1
Another: https://github.com/samyk/pwnat

Many of these exploits rely on insecure routers that have bugs, vulnerabilities or being badly configured, or a combination of them to get through NAT and into the internal network.

But this is just the network layer, if the victim machine has been compromised from a browser vulnerability, then NAT is irrelevant since the victim can just do NAT traversal or other methods to send/receive data/commands.
 
Well, insecure browser, insecure OS, insecure router...

I'd say any concept of security begins with owning your network. If your network is served from some home-box-router consumer thing, your network security is not high to begin with. When I was with ISP we would sometimes get complaints from gamers about ping and we could basically do stuff on their LAN from the router's management CLI. I'm sure it is all covered under laws but the option that somebody can put packets on your LAN is absurd in my head.

Having a secure network is cheap and I think every computer professional should have one, for me exploitable gateways are merely point of discussion, nobody should take that shit into account IRL...if you don't trust your router, change it.
 
Security isn't binary. A cheap lock on a bad door isn't great, but it surely beats not having a door in the first place.

Using an insecure web browser on an insecure operating system on a constantly and actively attacked internet for anything productive is... equivalent to not having a door. And drawing arrows on the walls.

The world of IPv4 is an active warzone. Trusting that vs trusting my ISP are different worlds, but neither deserves my house and SSH keys.
 
If the ISP or data center isn't trustworthy, no amount of caution at the user level will help. How much risk is acceptable is a user decision. One can suggest that people not do things with likely bad outcomes.

I have a system that can boot into Windows 7. I try to keep the browser and antivirus updated to current levels just in case but I also don't intend to browse the web from it.
 
Since we have established that sites such as Lowe's and Home Depot no longer work with Firefox on Windows 7, I tried getting into Home Depot using Chrome (same computer on windows 7) and from a Windows 10 machine using Norton Private Browser.

While both Chrome and NPB got into Home Depot, I noticed neither one really works. After searching for any product, the first page will appear. While there may be up to 20 items shown, it always says it is only showing items 1-4 of xxxx. And any attempt to go to page 2 just ends up back at page 1. So it appears there is a bit more going on with the changes that have been made.

Which leads me to a basic question, probably asked a million times before. If I want to stay on the Windows platform, do I constantly have to upgrade my OS and potentially my hardware just to browse the web?

Thanks...Joe
 
"do I constantly have to upgrade my OS and potentially my hardware just to browse the web?"

yes, and it is an operating system agnostic intentional "feature" of the corporate web
 
All of a sudden I have lost access to eBay as well once I sign in. Same type of errors issued by Lowes and Home Depot - "Something went wrong on our end". Best part of this...after going through the AI I finally got it to contact me with a real person. Then I get the message "Live assistance is not available". This online stuff is getting worse every day.

Anyone else lose access while using Win 7 and Firefox?

Thanks...Joe

P.S. Today I tried to sign into Walmart. After entering my user ID, I was given a choice of entering a password or getting a text with a code. I chose password. Once I entered my password, it sent me a text with a code which I needed to enter. Is it just me or have IT people lost their minds?
 
Windows 7 has been out of support for six years now (since mid January 2020). In addition, the last version of Firefox which supports Windoes 7 is Firefox 115 ESR and it only receives security updates.

I agree that things have gotten absurd in the department of logins, authentication, etc. Far too many people seem to lack the knowledge and critical thinking skills required to balance security with practicality.

However, the world has moved on and you have been left behind.
 
Joe. just a tip. You need to get W11 as things are only going to get worse for you down the line. W7 now is just a hit or miss thing and is bound tp cause you angst. I have W7 on my Ryzen gamer and it's a kludge to go on line, and I only do so to troubleshoot or update games on certain sites. Take care.

Tom
 
Robbbert said:
Let's see if @austin86 can provide the patch, presumably a .reg file, and then we can see what it does.

I know with XP and Vista the support for TLS 1.1 and 1.2 was there but disabled, you had to remove an entry from each section. I don't know if that was for the entire OS or just for IE8.
Click to expand...
I found the patch but its a lot more then just a reg key, to big to upload here and has modded system files and IDK if I can legally upload those. And TBH its not needed unless if you need the OS to nativity sport tls 1.3, apps can use it own their own.
 
Last edited:
Grandcheapskate said:
All of a sudden I have lost access to eBay as well once I sign in. Same type of errors issued by Lowes and Home Depot - "Something went wrong on our end". Best part of this...after going through the AI I finally got it to contact me with a real person. Then I get the message "Live assistance is not available". This online stuff is getting worse every day.

Anyone else lose access while using Win 7 and Firefox?

Thanks...Joe

P.S. Today I tried to sign into Walmart. After entering my user ID, I was given a choice of entering a password or getting a text with a code. I chose password. Once I entered my password, it sent me a text with a code which I needed to enter. Is it just me or have IT people lost their minds?
Click to expand...

I try the same sites on Linux, firefox or chrome, and hit those issues randomly, on a regular basis. Sometimes it's fine. I update my system fully, thinking, well maybe the latest browser will solve it: No. It's just bad design on their end. Same issues persist. I don't think this is really a Windows 7 or browser version issue. At this point, I don't think I will ever have an answer. It's totally a problem on their end.

Yes, on password handling, many companies are going pretty berzerk.
 
Have you been using a VPN? Some sites are trying desperately to block VPN access though without saying that a VPN is why you can't get through.

I find the whole insistence on sending an SMS to a phone when trying to login from a desktop silly. If my phone was close by, I would be doing everything from the phone. The site's need to ensure that they could send a notification to the phone if I ever enter the store just leads me to purchase from a less annoying competitor.
 
I do not have a VPN.
Today I was able to sign in again so it hopefully was an issue on their end.
And don't you just love it when a website asks you to verify your are human just to sign out?
 
Yeah I find it somewhat ironic when a machine asks you to prove you are human.

Firefox 115ESR support was extended to March 2027, although I'm already getting a few sites saying the browser is unsupported. Time to use R3dfox instead.
 
Grandcheapskate said:
I do not have a VPN.
Today I was able to sign in again so it hopefully was an issue on their end.
And don't you just love it when a website asks you to verify your are human just to sign out?
Click to expand...
I think maybe the reason for that is spam attacks and robotic antics.
 
I do not know what any of that means. All I can say is it's Firefox 152 made to work on Vista / 7 / 8 / 8.1 . Gets updated every few months in line with official Firefox, but you have to download and install the new version manually - there's no automatic updates.

It's a great thing especially for Vista, as it has no other browser that's even remotely up to date.
 
Istarian said:
Windows 7 has been out of support for six years now (since mid January 2020).
Click to expand...
Its worth noting there was 3 years of paid support for 7 after 2020 and its not hard to get those updates these days, think of it as the pos 2009 patch for xp. Not that I would recommend ether.
 
Robbbert said:
I do not know what any of that means.
Click to expand...
he is asking if it can use the GPU to decode/render HD video as appose to using the CPU, on sites like youtube and so on. I think there are ways to add it rather easily but I never mess with those things.
 
You must log in or register to reply here.
Back
Top