Tag: firefox

How to block Firefox from importing OS Certificate Authorities

Posted on by Martin Brinkmann

Mozilla’s Firefox web browser maintains its own root certificate store by default. The browser uses these as “trust anchors” and the functionality is essential for making sure that only trusted SSL/TLS certificates are used by the browser.

Starting in Firefox 120, Firefox will automatically trust operating sysdtem certificates installed by the user or an administrators.

The beta release notes offer the following explanation:

By default, Firefox now uses TLS trust anchors (e.g., certificates) added to the operating system by the user or an administrator. This works on Windows, macOS, and Android, and it can be turned off in the “Privacy & Security” section of Firefox settings, under “Certificates”.

Administrators may add certificates to the operating system for a number of reasons. Some applications and devices may require them to work properly, and they may also be required in development environments. Antivirus solutions on Windows may try and register with Firefox to monitor data.

Blocking Firefox from trusting OS certificates

Firefox block third-party root certificates installed by the user

Firefox users may disable the functionality in Firefox 120 and newer versions. It is enabled by default. To modify this setting, follow these instructions:

  1. Load about:preferences#privacy in the Firefox address bar to open the Privacy settings.
  2. Scroll down to the Security section.
  3. Locate Certificates there.
  4. Remove the checkmark from “Allow Firefox to automatically trust third-party root certificates you install”.

You can undo the change at any time by checking the box again.

Another certificate preference

Firefox supports an Enterprise root preference already. When the browser runs into a TLS connection error, it will enable this Enterprise Roots preference automatically. This imports “any root certificate authorities” that users or administrators have added to the operating system.

Firefox tries to connect again to the site that threw the error. If successful, Firefox will keep the preference enabled and thus also the imported certificates.

Here is how this automatic behavior gets disabled:

  • Load about:config in the Firefox address bar.
  • Click “Accept the Risk and Continue” if the warning page is displayed.
  • Search for security.certerrors.mitm.auto_enable_enterprise_roots.
  • Change the value from True to False with a double-click or by using the button.
  • Search for security.enterprise_roots.enabled.
  • Change the value from True to False.
  • Restart the Firefox web browser.

Closing Words

Most Firefox users may want to keep the default as these are designed to minimize connection errors and issues. Users who want to be in full control may disable the functionality, on the other hand.

Firefox will get Early Hints support

Posted on by Martin Brinkmann

Mozilla plans to integrate support for Early Hints in the Firefox web browser. The feature may improve the time it takes to load webpages by up to 30% according to early studies.

Cloudflare announced Early Hints back in 2021 as a novel way to speed up the loading of webpages. Then, in 2022, the company announced a collaboration with Google and Shopify to establish Early Hints.

Early Hints explained

Whenever a user instructs a browser to open a webpage, some time is spend waiting. Some of the wait time depends on the user’s Internet connection and the website’s servers.

When a browser connects to a site, it requires instructions to know what to render and which resources it needs to fetch. The server provides the instructions. Often, servers require a bit of time to generate the list that they need for their response to the browser.

Traditionally, during that time, browsers don’t do anything. This changes with the introduction of Early Hints. Think of the feature as a way for the server to tell the browser where to start right away.

Instead of waiting for the full list of instructions and resources, the feature gives the browser some instructions. The browser may then use the information to start processing data, even before all instructions are provided by the server.

Early Hints is a web standard that defines the HTTP status code 103. You can read the linked blog posts for additional technical details.

Web Browser Support

Early Hints Test Page

Google implemented Early Hints support in Chrome 103 and Apple introduced support in Safari 17. Chromium-based browsers should also support the feature by and large.

You can point your browser to this page to find out if it supports the feature.

Mozilla Firefox will soon support the new technology as well. Mozilla confirmed this on Bugzilla. There, Mozilla writes:

The early-hints-preconnect showed overall positive results and we would like to enable Early Hints preconnect in the next version. An experiment on Early Hint preload will follow.

It looks as if Firefox 120 will support Preconnect only and that the full feature, Preload, will be introduced at a later point in time.

Closing Words

The integration in Firefox ensures support for Early Hints in all major browsers. While it will take a bit of time before the full feature lands in Firefox, Firefox users may notice speed improvements in Firefox 120 already. Firefox 120 looks to be a big release, as it will also block cookie banners.

Firefox 120 will block cookie banners, but only in Germany

Posted on by Martin Brinkmann

Mozilla plans to enable cookie banner blocking in Firefox 120, but initially only in Germany. Other regions will follow at later point in time. Firefox users may, however, enable the blocking already.

Many websites display cookie consent banners to users. These banners give website visitors a choice regarding the use of cookies.

Cookies are data that websites may save on the local system. The sites may read the data in future visits. Cookies are useful, as they may keep the user signed-in or store preferences. Cookies are also used for tracking purposes.

The rise of cookie banners coincided with new regulatory laws in the European Union, California and some other regions. The main idea was to put users in control again in regards to cookies.

What was once thought of as a good idea turned into a huge annoyance for users. More or less all websites display cookie banners to users now, which often means that users have to interact with these banners frequently.

It is an annoyance, especially since there is no “don’t allow” default option that the browser sends automatically. Users who delete cookies regularly will get these banners in each browsing session.

Firefox 120: cookie banners be gone

Mozilla plans to introduce automation in Firefox 120 in Germany to block cookie banners and select “decline” whenever possible. The web browser will block cookie banners that include an option to refuse all but necessary cookies.

It should be clear that users will continue to see cookie banners. There is no standard for showing them to users and sites may use third-party scripts or custom scripts for the functionality.

Still, Firefox 120 will block common cookie banners, which should reduce the number of banners that users see while using the browser.

How to enable cookie banner blocking in Firefox

Firefox Cookie Banner blocking preferences

Mozilla plans to launch the feature in Germany only, but all Firefox users may configure the browser to block banners. I mentioned this back in 2022 on Ghacks.

  1. Load about:config in the Firefox address bar.
  2. Use the search field at the top to find cookiebanners.service.mode.
  3. Change the value of the preference to 1.
  4. Change the value of cookiebanners.service.mode.privateBrowsing to 1 as well. This enables the functionality in the private browsing mode.
  5. Restart Firefox.

The preference supports three values:

  • 0 — disables the feature. In other words, no cookie banners are blocked.
  • 1 — blocks all known cookie banners and does nothing otherwise.
  • 2 — blocks all known cookie banners and accepts any cookie banner otherwise.

Dealing with cookies

Tracking is severely limited if third-party cookies are blocked in the browser. Other options include deleting cookies and site data regularly.

Firefox ships with tracking protection functionality. While not as good as a true content blocker, such as uBlock Origin, it is better than nothing.

Blocking third-party cookies is a good idea to reduce tracking. Firefox makes this a bit complicated, as it does not offer a simple switch to turn off third-party cookies like Chromium-based browsers do.

  1. Load about:preferences#privacy in the browser’s address bar.
  2. Select the Custom option under Enhanced Tracking Protection.
  3. In the cookies menu, select “All cross-site cookies (may cause websites to break)”.

This blocks third-party cookies in the browser. Note that some, very few, sites may not work properly with this setting.

Closing Words

Several browsers deal with cookie banners automatically. Brave Browser has a cookie consent blocking feature and so does Vivaldi Browser.

Mozilla is a bit late to the party, but better late than never, especially if the feature improves usability. Firefox 120 will be released on November 21, 2023.

Now You: how do you deal with cookie banners? (via Sören Hentzschel)