![[topcap]](/images/floating_sidebar_topcap.png){kind=small}
![[bottomcap]](/images/floating_sidebar_bottomcap.png){kind=small}
Mozilla’s Firefox browser claims to provide a safer browsing experience out of the box, but some of the best security features of Firefox are only available as extensions. Here’s a roundup of some of the more useful ones I’ve found.
- Add n’ Edit Cookies
This might be more of a web developer tool, but being able to view in detail the cookies that various sites set on your visits can be an eye-opening experience. This extension not only shows you all the details, but lets you modify them too. You’ll be surprised at how many web apps do foolish things like saving your password in the cookie. - Dr. Web Anti-Virus Link Checker
This is an interesting idea — scanning files for viruses before you download them. Basically, this extension adds an option to the link context menu that allows you to pass the link to the Dr. Web AV service. I haven’t rigorously tested this or anything, but it’s an interesting concept that could be part of an effective multilayer personal security model.
- FormFox
This extension doesn’t do a whole lot, but what it does is important — showing a tooltip when you roll over a form submission button of the form action URL. Extending this further to visually differentiate submission buttons that submit to SSL URLs would be really nice (as suggested by Chris Shiflett).
- FlashBlock
Flash hasn’t been quite as popular an attack vector as Javascript, but it still potentially could be a threat, and it’s often an annoyance. This extension disables all embedded Flash elements by default (score one for securing things by default), allowing you to click to activate a particular one if you like. It lacks the flexibility I’d like (things like whitelists would be very handy), and doesn’t give you much (any?) info about the Flash element before you run it, but it’s still a handy tool. - LiveHTTPHeaders & Header Monitor
LiveHTTPHeaders is an incredibly useful too for web developers, displaying all of the header traffic between the client and server. Header Monitor is basically an add-on for LiveHTTPHeaders that displays a chosen header in Firefox’s status bar. They’re not really specifically security tools, but they do offer a lot of info on what’s really going on when you’re browsing, and an educated user is a safer user. - JavaScript Option
This restores some of the granularity Firefox users used to have over what Javascript can and cannot do. I’d like to see this idea taken farther (see below), but it’s handy regardless. - NoScript
This extension is pretty smooth. Of all the addons for Firefox covered here, this is the one to get. NoScript is a powerful javascript execution whitelisting tool, allowing full user control over what domains allow scripts to run. Notifications of blocked execution and the allowed domain interface are nearly identical to the built-in Firefox popup blocker, so users should find it comfortable to work with. NoScript can also block Flash, Java, and “other plugins;” forbid bookmarklets; block or allow the “ping” attribute of the tag; and attempt to rewrite links that execute javascript to go to their intended donation without triggering the script code.The one thing I’d really like to see from this extension would be more ganularity over what the Javascript engine can access. Now it’s only “on” or “off,” but being able to disable things like cookie access would eliminate a lot of potential security issues while still letting JS power rich web app interfaces. Also read Pascal Meunier’s take on NoScript.
- QuickJava
Places handy little buttons in the status bar that let you quickly enable or disable Java or Javascript support. Note that this will not work with the latest stable Firefox (1.5.0.1). Hopefully a new version will be available soon. - ShowIP
This is another tool that isn’t aimed at security per se, but offers a lot of useful information. ShowIP drops the IP address of the current site in your status bar. Clicking on it brings up a menu of lookup options for the IP, like whois and DNS info. You can add additional web lookups if you like, as well as passing the IP to a local program. Handy stuff.
- SpoofStick
The idea with this extension is to make it easier to catch spoofing attempts by displaying a very large, brightly colored “You’re on ” in the toolbar. For folks who know what they’re doing this isn’t wildly useful, but it could be just the ticket for less savvy users. It requires a bit too much setup for them, though, and in the end I think this is something the browser itself should be handling.
- Tamper Data
Much like LiveHTTPHeaders, Tamper Data is a very useful extension for web devs that lets the user view HTTP headers and POST data passed between the client and server. In addition, Tamper Data makes it easy for the user to alter the data being sent to the server, which is enormously useful for doing security testing against web apps. I also like how the data is presented in TD a bit better than LiveHTTPHeaders: it’s easier to see at a glance all of the traffic and get an overall feel of what’s going on, but you can still drill down and get as much detail as you like.
Got more Firefox security extensions? Leave a comment and I’ll collect them in an upcoming post.
del.icio.us »
Digg this »
March 17th, 2006 at 11:59 am
under the principles of the Attention Trust a way to securely store and share your clickstream data.
http://www.attentiontrust.org/services
March 17th, 2006 at 12:02 pm
[...] read more | digg story [...]
March 17th, 2006 at 12:20 pm
Has anyone ever coded a greasemonkey script or other extension to add GPG support to Gmail? That’d be the killer app security extension IMHO.
March 17th, 2006 at 12:27 pm
Personally I’d like to see an extension that allows Firefox to support ftps. Either a 2 paned drag/drop type ftp client that supports ftps, or simply being able to put in ftps:// in the address window.
March 17th, 2006 at 12:44 pm
[...] read more | digg story [...]
March 17th, 2006 at 12:48 pm
List of Firefox security extensions…
Here’s a good selection of Firefox security extensions on the CERIAS, Purdue University website. Of these, NoScript is probably the best one - this will offer you a high level of protection.
(via Sunbelt Blog )
……
March 17th, 2006 at 12:54 pm
I found these 50 Best Extensions For Firefox which you might like.
http://www.quickonlinetips.com/archives/2005/12/50-best-firefox-extensions-for-power-surfing/
March 17th, 2006 at 12:57 pm
You should check out MIT’s Siteadvisor. It’s an extension for Firefox that rates most of the sites on the web. It’s difficult to explain, go see for yourselves.
March 17th, 2006 at 1:02 pm
Cookie Button is quite useful. it allows you to manage site’s cookies with a single click. For a privacy freak like me, a must-have.
http://basic.mozdev.org/cookiebutton/
March 17th, 2006 at 1:55 pm
Good List of plugins. Blocking of Flash is quite useful.
March 17th, 2006 at 2:08 pm
For those with real privacy concerns, both SafeCache and SafeHistory plug holes in Firefox that are used to track you around the web. http://www.safecache.com
http://www.safehistory.com
March 17th, 2006 at 2:28 pm
I made VerifyURL when SpoofStick first came out. It’s very similar, but I made it when SpoofStick had its own toolbar, which I didn’t like. It just adds a context menu item and toolbar button with the “show hostname” javascript bookmarklet that’s been around for quite a while. I decided to make it into an extension with a button when the first good Firefox UI spoof came out, and I couldn’t access the bookmarklet in my bookmarks bar because of the spoofed UI. I actually prefer the new SpoofStick, but this is handy for those who want a quick way to check the hostname, without having SpoofStick show it all the time.
http://invisibill.mozdev.org/verifyurl/
March 17th, 2006 at 2:31 pm
Re: Zate — “Personally I’d like to see an extension that allows Firefox to support ftps. Either a 2 paned drag/drop type ftp client that supports ftps, or simply being able to put in ftps:// in the address window.”
First off… Google is your friend, second, searching for extensions yourself before hijacking someone’s blog == good.
Thirdly
Try out FireFTP: https://addons.mozilla.org/extensions/moreinfo.php?id=684&application=firefox
March 17th, 2006 at 3:29 pm
[...] Heres a nice collection of Fire Fox extensions that will help make your browser more secure definetly worth checkin’ out! < ?php wp_sociable(’simpy,delicious,yahoo,digg’); ?> [...]
March 17th, 2006 at 3:57 pm
[quote]
Extending this further to visually differentiate submission buttons that submit to SSL URLs would be really nice (as suggested by Chris Shiflett).
[/quote]
See my greasemonkey script here:
http://www.phpdoc.info/greasemonkey/ssl-indicator.user.js
S
March 17th, 2006 at 4:17 pm
Just a quick correction - Flashblock does indeed support whitelists. I’m running 1.5.1 and have a few sites whitelisted myself, but i’m pretty sure this functionality dates back a bit to previous branches.
March 17th, 2006 at 4:29 pm
Passwordmaker is an excellent password manager extension.
March 17th, 2006 at 4:52 pm
[...] http://www.cerias.purdue.edu/weblogs/coj/secure-it-practices/post-22/ [...]
March 17th, 2006 at 8:09 pm
Navegación segura en Firefox…
Una lista con las extensiones más útiles para Firefox relativas a la seguridad en la navegación: Add n’ Edit Cookies, Dr. Web Anti-Virus Link Checker, FormFox, FlashBlock, LiveHTTPHeaders, Header Monitor, JavaScript Option, NoScript, QuickJava, Sh…
March 17th, 2006 at 8:22 pm
[...] באתר זה תוכלו להוריד תוספי אבטחה לדפדפן Firefox [...]
March 17th, 2006 at 11:10 pm
[...] Visit [The List at CERIAS Weblogs] [...]
March 18th, 2006 at 12:46 am
[...] read more | digg story [...]
March 18th, 2006 at 1:25 am
[...] read more | digg story [...]
March 18th, 2006 at 1:34 am
Firefox Security Extensions…
We all know there are hundreds of firefox extensions and more are released with every passing day. It´s a time consuming task to stay up to date, that´s when pre compiled lists of useful firefox extensions come into play. This one at cerias (The Cen…
March 18th, 2006 at 3:55 am
Good job!
March 18th, 2006 at 11:57 am
[...] Need some extra security in your browsing experience? Take a look at this list and hopefully it will be the solution to your security sorrows. Firefox claims to the most secure browser out there, how does it stand up with these tools? Some of the included extensions are Add n’ Edit Cookies, Dr. Web Anti-Virus Link Checker, and FormFox. Tags: security, firefox, extensions [...]
March 18th, 2006 at 2:04 pm
The Netcraft toolbar now available as a Firefox plug, is very useful.
March 18th, 2006 at 6:20 pm
[...] Mozilla Firefox deve il suo successo soprattutto alla convizione di molti che sia un browser più sicuro del concorrente Internet Explorer. Questo è vero, ma solo se si installano le estensioni giuste. Sul blog del centro CERIAS dell’Università di Purdue sono elencate le 11 estensioni che rendono Firefox un browser davvero sicuro (noi ne riportaimo 9): [...]
March 18th, 2006 at 6:40 pm
A great extension you may find useful is the Web Developer Toolbar. As the name states, it’s made for web developers, but it has many features that are good for security.
For instance, you can disable JavaScript, Java and Referers. You can display form details to see the action URL. You can display the page’s JavaScript. You can see the response headers. You can clear your cache and history with a click in the toolbar. And a lot more.
March 18th, 2006 at 7:55 pm
Another excellent extension is PrefBar (more aimed at the developer or more tech savvy user), which allows you to add a toolbar of common preference items that you might want to change. I’ve got things like turnong on off Javascript, Java, Send Referrer, changing font sizes, changing the User Agent, clearing the cache and more.
March 18th, 2006 at 9:05 pm
[...] Firefox Safety Extensions CERIAS, the information security center based at Purdue, provides a list of Firefox Net Security Extensions. [...]
March 19th, 2006 at 8:54 am
[...] Now after reading this post on security extensions for firefox I have decided to install two more: [...]
March 19th, 2006 at 6:39 pm
[...] O browser Firefox é bastante mais seguro que o Internet Explorer; no entanto, grande parte dessa segurança advém das múltiplas extensões disponíveis para o programa. O site americano CERIAS, dedicado à segurança online, disponibiliza uma lista de extensões indispensáveis a todos os que utilizam o browser da Fundação Mozilla. » CERIAS (lista de extensões de segurança para o Firefox). [...]
March 20th, 2006 at 1:38 am
I have established Firefox for testing, and now IE I do not use. Firefox
Not quickly under attitude(relation) Opera, but it is a lot of Extensions for different has put
March 20th, 2006 at 6:21 am
[...] Y para cerrar, una lista de extensiones de seguridad para Firefox. Technorati Tags: privacidad seguridad [...]
March 20th, 2006 at 7:28 am
[...] Padraic CERIAS Weblogs » Useful Firefox Security Extensions [...]
March 20th, 2006 at 8:03 am
Thanks for the list. I tried SpoofStick and have settled on Petname Tool instead. See https://addons.mozilla.org/extensions/moreinfo.php?id=957&application=firefox
Rather than just yell the URL at you (like SpoofStick), Petname shows a small coloured box at the top of the screen. This box is grey when you’re at an HTTP site, yellow when you’re at a new HTTPS site, and green when you’re at an HTTPS site that you’ve previously been to and named (with your own pet name).
Very simple and clean, and based on some security research work (discussed in Schneier’s blog a few months back).
March 20th, 2006 at 10:16 am
[...] Useful Firefox Security Extensions (tags: Tech WebDev Firefox) [...]
March 22nd, 2006 at 12:40 am
The Doctor has a very cool plugin…
Ed Finker’s recent article points out an interesting extension that I was not aware of until reading about it. Although online virus checkers are not new they are relatively unknown outside of the security industry. Now one of them has a Firefo…
March 24th, 2006 at 2:17 pm
I like FF to make a FF registry repair that you could run to fix extensions.It would be unbeatable then.
March 25th, 2006 at 6:33 am
Useful Firefox Security Extensions…
Useful Firefox Security Extensions - extensions which improve security but are also useful for web development….
April 4th, 2006 at 11:46 am
JEG VIL HA LITT IS!!! ELLERS
April 12th, 2006 at 8:57 am
[...] We all know there are hundreds of firefox extensions and more are released with every passing day. It´s a time consuming task to stay up to date, that´s when pre compiled lists of useful firefox extensions come into play. This one at cerias (The Center for Education and Research in Information Assurance and Security) lists firefox security extensions that are security related. [...]
April 24th, 2006 at 6:53 pm
Nice !!
How about a search engine kind of an add-on which will send the typed IP address to Samspade.org and do a “Do Stuff” on it.
But then that would be a mere tool extension into Firefox.
April 25th, 2006 at 12:58 am
I am using the Netcraft Anti-Phishing Toolbar which tell me who owns a particular domain/IP, for how long and gives a sense of security against phishing attacks. Highly recommended.
Harish
April 25th, 2006 at 5:06 am
I use the netcraft toolbar: https://addons.mozilla.org/firefox/1326/
April 27th, 2006 at 8:50 pm
[...] Security extensions [...]
May 3rd, 2006 at 3:39 am
Firefox has a new version available for download. According to this site ( http://www.listerit.com/faqs/blog/firefox-faqs/firefox-users-should-upgrade-to-version-1.5.0.3.html ) Firefox users should upgrade to version 1.5.0.3
A recent ( http://www.mozilla.org/security/announce/2006/mfsa2006-30.html )Mozilla Security Bulletin explains that a possible exploit exists in Firefox version 1.5.0.2 that can cause browser crashes and run malicious code.
To obtain the latest version of Firefox visit:
http://www.mozilla.com/firefox/
May 11th, 2006 at 4:24 pm
AdBlock combined with Filterset.G is also highly useful. Plus a hosts file is useful for whatever browser you are using.
May 19th, 2006 at 1:23 pm
[...] read more | digg story [...]
May 26th, 2006 at 1:59 pm
[...] As promised, I’m following up my previous post about security extensions for Firefox with suggestions from readers. Some of these are basically different solutions to similar problems — which is great, because some users will prefer one approach over another. A couple of these are very useful, though, and should be considered essential parts of a secure browsing platform. And one seems very useful, but raises privacy issues that are a little troubling. [...]
May 30th, 2006 at 12:37 pm
[...] Firefox Security extensions Pt. 1 Firefox Security extensions Pt. 2 [...]
June 9th, 2006 at 8:46 am
[...] We all know there are hundreds of Firefox extensions and more are released with every passing day. It´s a time consuming task to stay up to date, that´s when pre compiled lists of useful Firefox extensions come into play. This one at cerias (The Center for Education and Research in Information Assurance and Security) lists firefox security extensions that are security related.The author lists 11 extensions, some known ones like LiveHttpHeaders and NoScript and lots of unheard ones like formfox. Each extension is explained in detail and linked to the mozilla website for more information and downloading. [...]
August 23rd, 2006 at 10:40 pm
As i see Google banned this site https://addons.mozilla.org/firefox/
My google PR is grey
August 25th, 2006 at 2:53 am
to protect our privacy, we should own our security software!
August 30th, 2006 at 8:00 am
[...] I just need something basic on my mac, so I plan on using firefox’s builtin RSS as opposed to something like newsfire. I found a plugin that can import OPML files to import my rss list. (some other good plugins) [...]
September 1st, 2006 at 2:45 am
[...] Firefox’s extensions are one of its biggest selling points. Looking for ones that will help make your browsing more secure? Check out this list.read more | digg story [...]
September 1st, 2006 at 8:20 pm
[...] CERIAS Weblogs » Useful Firefox Security Extensions (tags: Firefox security Extensions extension web software browser) [...]
September 26th, 2006 at 6:49 pm
[...] El autor ha colocado en este enlace otras extensiones recomendables, como Add n’ Edit Cookies, Dr. Web Anti-Virus Link Checker, FormFox, FlashBlock, LiveHTTPHeaders & Header Monitor, JavaScript Option, NoScript, QuickJava, ShowIP, SpoofStick y Tamper Data. No dejéis de echarle un ojo. [...]
November 11th, 2006 at 1:47 pm
[...] Security extensions [...]
January 8th, 2007 at 12:51 am
[...] If you are a FireFox user, you might want to check out this post, and this one. [...]
January 29th, 2007 at 11:36 am
[...] 11. 11 Useful Firefox Security Extensions … [cerias.purdue.edu/ March 17, 2006] Categories: security / web development [...]
April 19th, 2007 at 2:25 am
[...] vallomásai, miért használnak FF-ot: Teri Vogel (UCSD) - egy rakat kiterjesztés, CERIAS - biztonsági kiterjesztések, Walk Like a Librarian - beállítás és testreszabás [...]
May 4th, 2007 at 12:42 am
[...] Useful Firefox Security Extensions - Excellent list [...]
May 19th, 2007 at 3:13 pm
Ed Finkler
First i got your page from the, “SunBeltBlog”
I belong to Countless Security Groups like CastleCops” And others i have just started a Mini-Blog inside my Guitar site.
I,ve been working with Computers since the 80s also back then i run a local bbs” in Lafayette In.About Firefox Extenions other group i’m in (EHC)Also the 2 Groups below.
http://www.shadowserver.org/wiki/pmwiki.php?n=Stats.BotCounts
http://www.professionalsecuritytesters.org/
https://addons.mozilla.org/en-US/firefox/browse/type:1/cat:12
Also there some hidden new Extensions
Hidden in FireFox for 2002-3
Now also i’m a Reporter for Sunbelt which i go undercover and get News for the SunbeltBlog.I started out beta testing all malware programs including Sunbelts CounterSpy2 New Viper engine)
I ‘m now testing a Sandbox which makes newusers safer.I use Firefox in a Sanbox,
which if anything gets in it can;t move.
I do use a souped up hosts file and and about 25 tools to come face to face with the bad guys on irc plus thier bad sites.
So if you ever want good info on surfing safe.I would can give you very good info from out in the wild.If your not out there then you don’t know how bad it really is.You can read from the sites i give you.
Now most of the tools you mention will not work with firefox 2002 or 3.
Surf Safely .
Also My wife works at Purdue u.
Your Truly Mark Toman ech….
July 20th, 2007 at 6:32 am
[...] autor ha colocado en este enlace otras extensiones recomendables, como Add n’ Edit Cookies, Dr. Web Anti-Virus Link Checker, [...]
July 27th, 2007 at 6:58 am
Wondering if there is a way to block firefox or scripts run in it from accessing the registry and file system?