Browser Security

Browser Security Di Matteo Valerio 1379412 dimatteo.1379412@studenti.uniroma1.it ABSTRACT Today, most of the concern over web security is concentrated on the web applications, but actually, the specific browser that users utilize to surf the web is a key factor in terms of security aspects. A bad secured browser can turn all the efforts to enhance security of web applications useless, and expose personal or sensible data. There should be a set of basic requirements that browsers should have in order to be considered secure, or at least “securable”.

Keywords Browsers, Security, Infosec, Google Chrome, Mozilla Firefox, add-ons.

1. INTRODUCTION Information security, sometimes shortened to InfoSec, is the practice of defending information from unauthorized access, use, disclosure, disruption, modification, perusal, inspection, recording or destruction. It is a general term, which may refer to electronic, physical, or any kind of form that data may take.

As a matter of fact, security is often thought as something that belongs to the application-side of a system, as if browsers were only passive elements.

Instead, browser security is fundamental if we want to guarantee a certain level of protection.

Nowadays, the various vendors provide various way to enhance the browser’s security, with different options or functionalities that can be selected and enabled/disabled to the user’s will. On one side, this allows the user to choose what he want to have at his disposal (for example, whether he wants to use cookies or not), while on the other hand, the fact itself that users can have a choice leads to bad decisions and security breaches. Some think that security should me “transparent”, in the sense that users shouldn’t need to think about what is happening in order to protect them, but the browser should manage it all by itself.

It is not an easy task, however, because as we will see, most of the times a security enhancement comes

at the cost of the user experience in terms of quality or availability of a certain resource.

In this paper, we tried to list down a set of basic InfoSec requirements that all web browsers should have, in order to provide a good level of security in web browsing without lowering the quality of the experience of the user.

We will also show how to make Google Chrome and Firefox as secure as possible by applying the methodologies that we will discuss and, in particular, we will define a set of add-ons for Mozilla Firefox, studying and analyzing then and explaining the details of their configuration.

Finally, we also tested the effectiveness of the selected add-ons on three popular web platforms: Facebook, Youtube and Amazon.

Note: many definitions for technologies and plug-ins come from Wikipedia or other public Internet source, as they are only needed to introduce them and to explain why they have been selected. Some configuration instructions for Chrome and Firefox, like paths to specific URLs or settings folders, or lists of possible choices, come from their own help pages.

The particular choices of the single technologies, why we picked them, and the suggested options to be selected on the browsers, as well as the study of the user experience after the installation of the add-ons and the tests on Facebook, Youtube and Amazon, is

Di Matteo Valerio 1379412

Browser Security

instead totally original, and constitutes the main goal and the core of this paper.

communicate across a network in a way designed to prevent eavesdropping and tampering). They use X.509 certificates (asymmetric cryptography) to authenticate the counterparty with whom they are communicating, and to negotiate a symmetric key. This session key is then used to encrypt data flowing between the parties. This allows data/message confidentiality, message authentication and message integrity. Several versions of the protocols are in widespread use in applications such as web browsing, electronic mail, Internet faxing, instant messaging, and voice-over-IP (VoIP).

An important property in this context is forward secrecy, so the short-term session key cannot be derived from the long-term asymmetric secret key.

2. Basic requirements We tried to list down a few basic requirements that we think are needed, in order to consider a browser to be secure. They are: 

HTTPS support



TSL/SSL support



Java/Javascript enabling/disabling



ActiveX enabling/disabling



Plug-ins management (activate/block)



Cookies management (enable/disable/delete)



Phishing protection



Malware protection



Anti-virus integration



Pop-up blocking



Same-origin policy



Sandbox utilization



Security headers



Options to change security parameters

Elective C.N. WAS, 2014/2015

One of the knows vulnerabilities is that it needs Certificate Authorities, but their weakness could allow main-in-the-middle attacks.

2.3 Java/Javascript Java can be a huge threat for security, as Java applets are provided by Web sites and are executed by a JVM instanced by the browser. In principle, they are more secure than ActiveX because they are run inside a sandbox, but they can be buggy and vulnerable.

There exists a US-CERT “Vulnerability Notes Database for Java”.

2.1 HTTPS

Javascript is also a threat because it can help attacks such as SQL-injection, it is needed to manage supercookies (which are an issue for privacy) and is used to get fingerprint information, too.

HTTPS (HTTP Secure) is a protocol for secure communication over a computer network, especially deployed on the Internet. It is the result of simply layering the Hypertext Transfer Protocol (HTTP) on top of the SSL or TLS protocol, thus adding the security capabilities of SSL/TLS to standard HTTP communications. The main functionalities of HTTPS are authentication of the visited website and privacy and integrity protection of exchanged data. In fact, HTTP alone is insecure and is vulnerable to man-in-the-middle and eavesdropping attacks, which may allow attackers to gain access to website accounts and sensitive information, and modify webpages to inject malware or advertisements. HTTPS tackles such attacks and is considered secure against them.

Some users tend to disable Java and Javascript to enhance security, but sometimes this causes a loss in the surfing experience or in the availability of resources.

There exists a add-on for Mozilla Firefox called NoScript, that allows executable web content such as JavaScript, Java, Flash, Silverlight, and other plugins only if the site hosting is considered trusted by its user and has been previously added to a whitelist. We will cover it later.

2.4 ActiveX ActiveX is a software framework created

by Microsoft that adapts its earlier Component Object Model (COM) and Object Linking and Embedding (OLE) technologies for content downloaded from a network, particularly in the context of the World Wide Web.

2.2 TSL/SSL Transport Layer Security (TLS) and its predecessor, Secure Sockets Layer (SSL), are cryptographic protocols designed to provide communications security over a computer network (it allows client-server applications to 2

Di Matteo Valerio 1379412

Browser Security

It is used by Microsoft Internet Explorer on Windows hosts and allows the browser to use applications or parts of them. The components can be downloaded from the Web site or can already be installed on the host. It is not a programming language, but an extension of a predisposed application.

ActiveX controls are files containing commands and functions. IE can import them to exploit their power.

They have access to the whole Windows system.

They integrate many advanced functions but can expose users to attack or unwanted software installation.

Elective C.N. WAS, 2014/2015

The original usage was to implement shopping carts, but then they began to be used to differentiate users’ experience, customizing pages, and to track them, to personalize advertisements. Third-party cookies are those sent by a Web page that hosts contents of an other Web page (like advertisement banners or web bugs, that are small invisible images). Users can thus be tracked across different Web sites and profiled, with obvious concerns about privacy issues.

Just like for Java, some users prefer to disable ActiveX, with subsequent loss in quality of experience.

Finally, there are also super cookies (zombie cookies, ever cookies) that are persistent in the computer and cannot be easily removed, and sometimes even recreate themselves. This is clearly an issue for privacy and security and browsers cannot yet manage them, but a few add-ons are being developed.

There exists a US-CERT “Vulnerability Notes Database for ActiveX”.

2.7 Phishing Phishing is the attempt to acquire sensitive information such as usernames, passwords, and credit card details (and sometimes, indirectly, money), often for malicious reasons, by masquerading as a trustworthy entity in an electronic communication.

Phishing emails may contain links to websites that are infected with malware. Phishing is typically carried out by email spoofing or instant messaging, and it often directs users to enter details at a fake website whose look and feel are almost identical to the legitimate one. Phishing is an example of social engineering techniques used to deceive users, and exploits the poor usability of current web security technologies.

2.5 Plug-ins A browser extension is a computer program that extends the functionality of a web browser in some way. Depending on the browser and the version, the term may be distinct from similar terms such as plugin or add-on.

Plug-ins add specific abilities into browsers using application programming interfaces (APIs) allowing third parties to create plug-ins that interact with the browser. The original API was NPAPI, but it could be subject to techniques like buffer overflow or suffer cross-domain violations when the “same origin” policy was not complied; subsequently Google introduced the PPAPI interface in Chrome. In addition, plug-ins allow browser extensions to perform tasks such as blocking ads, creating a secure online connection, and adding applications with in a browser.

Phishing is used to portray trust in the user since the user may not be able to tell that the site being visited or program being used is not real, and when this occurs is when the hacker has the chance to access the personal information such as passwords, usernames, security codes, and credit card numbers among other things.

Some plug-ins can be a possible threat for browsers, but there are many well known add-ons that actually enhance the security of the system, like HTTPS Everywhere, NoScript, WOS and BetterPrivacy, or the quality of experience, like AdBlock.

Today’s browsers often include the possibility to activate anti-phishing mechanisms.

2.8 Malware

2.6 Cookies

Malware, short for malicious software, is any software used to disrupt computer operation, gather sensitive information, or gain access to private computer systems. Malware is defined by its malicious intent, acting against the requirements of the computer user, and does not include software that causes unintentional harm due to some deficiency.

The term badware is sometimes used, and applied to

Cookies are small files that are put on clients in order to store data useful to Web sites. They may include info on visited web sites or even credentials.

A cookie is only readable by the web site that created it and is sent back when that page is visited again. It can be a session cookie (removed when browser is closed) or a persistent cookie (stays until expiration).

3

Di Matteo Valerio 1379412

Browser Security

Elective C.N. WAS, 2014/2015

both true (malicious) malware and unintentionally harmful software.

inspect the host system or read from input devices are usually disallowed or heavily restricted.

Today, most browsers can detect pages containing malware and warn the user.

In the sense of providing a highly controlled environment, sandboxes may be seen as a specific example of virtualization. Sandboxing is frequently used to test unverified programs that may contain a virus or other malignant code, without allowing the software to harm the host device.

2.9 Anti-virus Antivirus or anti-virus software (often abbreviated as AV), sometimes known as anti-malware software, is computer software used to prevent, detect and remove malicious software.

Java applets are run inside sandboxes and HTML5 has a sandbox attribute for use with iframes.

Antivirus software was originally developed to detect and remove computer viruses, hence the name.

However, with the proliferation of other kinds of malware, antivirus software started to provide protection from other computer threats.

2.12 Security headers Security headers are provided by new emerging technologies like Content Security Policy (CSP) and HTTP Strict Transport Security (HSTS).

In today’s browsers there is often the possibility to activate anti-virus integration, to enhance protection when surfing the web.

Content Security Policy (CSP) is a computer security concept, to prevent cross-site scripting (XSS) and related attacks. It is a Candidate Recommendation of the W3C working group on Web Application Security. CSP provides a standard HTTP header that allows website owners to declare approved sources of content that browsers should be allowed to load on that page — covered types are JavaScript, CSS, HTML frames, fonts, images and embeddable objects such as Java applets, ActiveX, audio and video files.

2.10 Same-origin policy The same-origin policy is an important concept in the web application security model. Under the policy, a web browser permits scripts contained in a first web page to access data in a second web page, but only if both web pages have the same origin. An origin is defined as a combination of URI scheme, hostname, and port number. This policy prevents a malicious script on one page from obtaining access to sensitive data on another web page through that page's Document Object Model.

CSP was originally developed by the Mozilla Foundation and was first implemented in Firefox 4.

As of 2012 the CSP is a W3C candidate. The following header names are in use as part of an experimental CSP implementations:

This mechanism bears a particular significance for modern web applications that extensively depend on HTTP cookies to maintain authenticated user sessions, as servers act based on the HTTP cookie information to reveal sensitive information or take state-changing actions. A strict separation between content provided by unrelated sites must be maintained on the client side to prevent the loss of data confidentiality or integrity.



Content-Security-Policy — standard header name proposed by the W3C document. Google Chrome supports this as of version 25. Firefox supports this as of version 23, released on 6 August 2013.



X-WebKit-CSP — experimental header introduced into Google Chrome and other WebKit-based browsers (Safari) in 2011.



X-Content-Security-Policy — experimental header introduced in Gecko 2 based browsers (Firefox 4 to Firefox 22, Thunderbird 3.3, SeaMonkey 2.1).

2.11 Sandbox In computer security, a sandbox is a security mechanism for separating running programs. It is often used to execute untested code, or untrusted programs from unverified third parties, suppliers, untrusted users and untrusted websites. A sandbox typically provides a tightly controlled set of resources for guest programs to run in, such as scratch space on disk and memory. Network access, the ability to

Support for the sandbox directive is also available in Internet Explorer 10 and Internet Explorer 11 using the experimental X-Content-Security-Policy header.

4

Di Matteo Valerio 1379412

Browser Security

Elective C.N. WAS, 2014/2015

HTTP Strict Transport Security (HSTS) is a web security policy mechanism which is necessary to protect secure HTTPS websites against downgrade attacks, and which greatly simplifies protection against cookie hijacking. It allows web servers to declare that web browsers (or other complying user agents) should only interact with it using secure HTTPS connections, and never via the insecure HTTP protocol. HSTS is an IETF standards track protocol and is specified in RFC 6797.

A variation on the pop-up window is the popunder advertisement, which opens a new browser window hidden under the active window. Pop-unders do not interrupt the user immediately and are not seen until the covering window is closed, making it more difficult to determine which web site opened them.

The HSTS Policy is communicated by the server to the user agent via a HTTP response header field named "Strict-Transport-Security". HSTS Policy specifies a period of time during which the user agent shall access the server in a secure-only fashion.

For Google Chrome, the menu is Settings. For Firefox, it is simply Options. For Internet Explorer, the security options are in the Security tab of the Internet Options window. In section 3, details for their configuration are provided.

2.14 Options Today’s web browser allow users to change their preferred settings to enhance the security.

A server implements an HSTS policy by supplying a header over an HTTPS connection (HSTS headers over HTTP are ignored).

3. ADVANCED SECURITY CONFIGURATIONS 3.1 Google Chrome

When a web application issues HSTS Policy to user agents, conformant user agents behave as follows:

Chrome’s settings can be accessed by clicking on the Settings menu tab or by navigating to chrome://settings/. There, under the “Privacy” set of options, we can manage many of the features that we introduced.

1. Automatically turn any insecure links referencing the web application into secure links.

2. If the security of the connection cannot be ensured (e.g. the server's TLS certificate is not trusted), show an error message and do not allow the user to access the web application.

For instance, turn off the instance search, that sends anything that we type in the address bar to Google.

This helps a lot in tackling privacy issues, because parts of queries that we type can be used to infer on our interests and also determine advertisement banners.

The HSTS Policy helps protect web application users against some passive (eavesdropping) and active network attacks. A man-in-the-middle attacker has a greatly reduced ability to intercept requests and responses between a user and a web application server while the user's browser has HSTS Policy in effect for that web application.

By clicking on contents settings, we can also manage many other aspects and technologies. Chrome suggests not to change them if you don’t know what you are doing. We suggest to pay attention to antiphishing and anti-malware, cookies, images, Javascript, handlers, plug-ins, pop-ups, location, unsandboxed plug-in access and downloads.

2.13 Pop-ups Pop-up ads or pop-ups are often forms of online advertising on the World Wide Web intended to attract web traffic or capture email addresses. Popups are generally new web browser windows to display advertisements. The pop-up window containing an advertisement is usually generated

by JavaScript using cross-site scripting (XSS), sometimes with a secondary payload using Adobe Flash, but can also be generated by other vulnerabilities/security holes in browser security.

3.1.1 Anti-phishing and Anti-malware We can enable anti-phishing and anti-malware. When this is done, there are a few messages that will warn us in case we bump into a malicious page:

5



The Website Ahead Contains Malware! - The site you're trying to visit may install malware on your computer.



Danger: Malware Ahead! - The web page you're trying to visit may have malware.

Di Matteo Valerio 1379412

Browser Security



Reported Phishing Website Ahead! - The site you’re trying to visit is suspected of being a phishing site.



The site ahead contains harmful programs The site you're trying to visit may try to trick you into installing programs that harm your browsing experience. o

3.1.2 Cookies.

In the "Cookies" section, you can change the following cookies settings: 

Delete cookies: click “All cookies and site data” to open the Cookies and site data dialog. To delete all cookies, click “Remove all” at the bottom of the dialog. To delete a specific cookie, hover over the site that issued the cookie with your mouse, then click the X that appears on the right corner. To tell Google Chrome to automatically delete cookies when you close all your browser windows, select the "Keep local data only until I quit my browser" checkbox in the Content Settings dialog. You can also make exceptions so that specific sites’ cookies are deleted whenever you close your browser, or choose to remove all cookies created during a specific time period, using the Clear Browsing Data dialog.



Block cookies by default: to block all cookies, Select "Block sites from setting any data." Keep in mind that selecting this setting will prevent most sites that require you to sign in from working. At least, block thirdparty cookies to prevent to be tracked by advertisement companies: select the "Block third-party cookies and site data" checkbox. Even if you've added a site to the Exceptions list and have chosen to allow its cookies, the site's third-party cookies won't be accepted if this checkbox is selected.



Make website or domain-specific exceptions: to control how cookies should be handled for a few specific sites or domains, click “Manage exceptions”. To add a rule in the Cookie and Site Data Exceptions dialog that appears, follow these steps: o

Elective C.N. WAS, 2014/2015 

To create exceptions for an entire domain, insert [*.] before the domain name.



You can also specify an IP address, an IPv6 address, or a non-http URL.

Use the menu to choose whether the site can set cookies. If you select Clear on exit, its cookies are deleted every time you close your browser.

3.1.3 Images Images are allowed by default. To prevent images from displaying, select "Do not show any images".

This will help to avoid XSS attacks or other fake links and malicious features that often hide behind pictures, but be aware that you won’t see any of them; exceptions can be managed.

3.1.4 Javascript Disable Javascripts if you don’t trust them, because as we already mentioned they can be the mean through which many attacks are performed. If you choose to disable it, however, you may find that some sites don't work properly (ex: Facebook), so exceptions can be managed, or even temporary suspensions.

3.1.5 Handlers Chrome allows web services to ask if you’d like to use them to open certain links. While most links generally take you to another page, some links can open programs and perform other actions. For example, mailto: links can open your email program and webcal: links can add events to your calendar program. These links are referred to as protocols and the programs they use are called handlers. Many web services these days can act as handlers, but you can never know when a handler could open a malicious program.

By default, web services are allowed to show messages about protocol links when you visit their sites. To disable web sites to handle protocols, click “Do not allow any site to handle protocols”. You can also choose a default handler or remove one.

3.1.6 Plug-ins Chrome usually uses plug-ins by default, unless they are out of date, not used by many programs or clearly unsecure. To control what plug-ins are executed, click on “Let me run when to run plugin content”: Chrome

Click the "Add a new exception pattern" field and enter the domain name for which you want to create an exception.

6

Di Matteo Valerio 1379412

Browser Security

will stop any plugin from running automatically. You can run specific plugins by right-clicking on them and choosing Run this plugin. You can also manage exceptions and turn on/off individual plugins.

Elective C.N. WAS, 2014/2015

recommendations on their websites, and generate reporting statistics. As of now, Google says that most web services, including Google's owns, do not alter their behavior or change their services upon receiving Do Not Track requests.

3.1.7 Pop-ups By default, Google Chrome prevents pop-ups from automatically appearing and cluttering your screen. In case you enabled them and you need to disable them again, click on “Do not allow any site to show popups (recommended)”. You can also manage exceptions for individual web sites.

3.2 Mozilla Firefox Firefox’s security options can be accessed via the “Options” tab in the menu. The two main sets of interest are “Security” and “Privacy”.

3.2.1 Anti-phishing and Anti-malware Firefox contains built-in Phishing and Malware Protection to help keep you safe online. Phishing and Malware Protection works by checking the sites that you visit against lists of reported phishing and malware sites. These lists are automatically downloaded and updated every 30 minutes or so when the Phishing and Malware Protection features are enabled. To make sure it is enabled, in the “Security” option panel check the marks on “Block reported attack sites” and “Block reported web forgeries”.

3.1.8 Location Google Chrome never shares your location without your permission. By default, whenever you're on a site that wants to use your location information, Google Chrome alerts you by showing you a prompt at the top of the page. Your location is sent to the site only if you click Allow in the prompt.

The default option is, thus, “Ask when a site tries to track your physical location”, but you can click on “Do not allow any site to track your physical location” to automatically deny site requests for your location.

3.2.2 Cookies Cookie in Firefox can be easily deleted or blocked, for example to disallow websites to remember your login information or your credit card numbers.

3.1.9 Unsandboxed plug-in access Through sandboxing, Chrome helps protect you by limiting how much access some plug-ins have to your system. However, some websites require plug-ins to have direct, unsandboxed access, for example to install additional software on your computer, but it could be malicious. You can force a web site to ask you to run an unsandboxed plug-in by clicking on “Ask when a site wants to use a plug-in to access your computer (recommended)”, but you can also automatically deny all of them by choosing “Do not allow any sites to use a plug-in to access your computer”.

To remove them, in the Privacy panel, select “Use custom settings for history”: there, you can either search for individual cookies to be deleted, or remove all of them.

For better security, make sure that they are blocked: remove the check mark from “Accepting cookies from websites”, or at least block third-party ones by selecting “never”. You can also tell the browser to keep them until it closes, if you really don’t want to block them, so that they will eventually be deleted. It is also good to delete the history on browser quit.

This is all possible in the “Keep until” drop-down menu.

3.1.10 Downloads Disable automatic downloads to prevent content from being downloaded without your permission when opening a link, in order to be able to check the single files that the browser tries to download and avoid to store unwanted (and possibly malicious) content on your computer.

Individual page cookie management is possible, too, by accessing the Permissions section from the View Page Info menu tab.

3.2.3 Tracking To prevent tracking, type “about:config” in the location bar, then look for privacy.trackingprotection.enabled and make sure it is set to “true”. A shield will appear next to the location bar and will warn you when Firefox is blocking

3.1.11 Do Not Track It is good to include a "Do Not Track" request with your browsing traffic. However, many websites will still collect and use your browsing data to improve security, provide content, services, ads and 7

Di Matteo Valerio 1379412

Browser Security

tracking attempts. From there you can also temporarily disable it but this is strongly discouraged.

Elective C.N. WAS, 2014/2015

range of security and privacy issues. To install them, you simply need to click on the “Add to Firefox” button, and in some case restart the browser. To disable them, simply click the “disable” button. We selected five of them that we think are really important to tackle those issues.

3.2.4 Do Not Track Just like Google Chrome, Firefox has a Do Not Track feature that lets you tell every website you visit, their advertisers, and content providers that you don't want your browsing behavior tracked. Honoring this setting is, however, voluntary — individual websites are not required to respect it, so just like for Chrome it is not a guaranteed feature. Websites that do honor this setting should automatically stop tracking your behavior without any further action from you. Turning on this feature will not affect your ability to log in to websites nor cause Firefox to forget your private information, such as the contents of shopping carts, location information or login information.

4.1 NoScript NoScript (or NoScript Security Suite) is a free and open-source extension for Mozilla Firefox, SeaMonkey, and other Mozilla-based web browsers, created and actively maintained by Giorgio Maone, an Italian software developer and member of the Mozilla Security Group. NoScript allows executable web content such as JavaScript, Java, Flash, Silverlight, and other plugins only if the site hosting is considered trusted by its user and has been previously added to a whitelist. NoScript also offers specific countermeasures against security exploits.

To activate it, in the Privacy panel, check “Tell websites that I don’t want to be tracked”.

NoScript blocks JavaScript, Java, Flash, Silverlight, and other "active" content by default in Firefox. This is based on the assumption that malicious websites can use these technologies in harmful ways. Users can allow active content to execute on trusted websites, by giving explicit permission, on a temporary or a more permanent basis. If "Temporarily allow" is selected, then scripts are enabled for that site until the browser session is closed.

3.2.5 Add-ons In the “Security” section, under “General” options, mark the option about add-ons, so that Firefox will tell you when a website is trying to install an add-on.

Exceptions can be managed.

3.2.6 Password In the “Security” section, under “Password”, uncheck the option “Remember passwords”. Exceptions can be managed.

Because many web browser attacks require scripting, configuring the browser to have scripting disabled by default reduces the chances of exploitation. Blocking plug-in content, as well, helps to mitigate any vulnerabilities in plug-in technologies, such as Java, Flash, Acrobat, and so on. NoScript will replace these blocked elements with a placeholder icon. Clicking on this icon enables the element.

3.2.7 Javascript If you want to disable Javascript, navigate to about:config and set javascript.enabled as false.

3.2.8 Pop-ups Block pop-ups to avoid annoying advertisement pages to appear. In the “Contents” section, mark “Block pop-up windows”.

3.2.9 Automatic updates It is good to enable automatic updates in order to allow Firefox to be up to date with all the new issues and methods to tackle them. In the “Advanced” section, make sure that “Automatically install updates” is checked.

Scripts (and other blockable elements) are allowed or blocked based on the source from where the script is fetched. Very often, this source is not identical to the URL displayed in the address field of the web page.

No scripts are executed if the address of the main page is untrusted. Once any source is marked as trusted, NoScript will regard it as trusted even if it is loaded indirectly by web pages or scripts originating from other domains. Sites can also be blacklisted.

4. FIREFOX ADD-ONS By visiting the web page https://addons.mozilla.org/it/firefox/, we have access to a huge amount of add-ons for the Firefox browser.

In particular, by clicking on “Privacy and Security”, we can see that there exist many solutions to a wide

NoScript was also the first to provide client-side protection against Type 0 and Type 1 Cross-site 8

Di Matteo Valerio 1379412

Browser Security

scripting (XSS). Whenever a website tries to inject HTML or JavaScript code inside a different site, NoScript filters the malicious request, neutralizing its dangerous load.

The add-on sends user ratings to the WOT site, and it determines how the computed results are displayed, depending on user's settings. For instance, when visiting a poorly rated site a warning screen may pop up, or only a red icon in the user's browser tool-bar is shown. Color-coded icons are also shown next to external links on the pages of leading search engines, email services, social network sites and Wikipedia.

Ratings are cast by secret ballot. They can be given in the categories "trustworthiness" and "child safety".

To specify at least one reason for a rating is mandatory, via multiple choice in the rating interface.

The user rating system is meritocratic; the weight of a rating is algorithmically calculated for each user individually.

4.2 Ghostery Ghostery is a proprietary freeware privacy-related browser extension for Mozilla Firefox, Google Chrome, Internet Explorer, Opera, and Apple Safari owned by the advertising and privacy technology company Ghostery, Inc. (formerly Evidon). It enables its users to easily detect and control web bugs, which are objects embedded in a web page, invisible to the user, which allow collection of the user's browsing habits.

Ghostery blocks HTTP requests and redirects according to their source address in two ways: cookie blocking and cookie protection (where available).

When cookie protection is enabled, if a cookie is selected from Ghostery's list, it is not accessible to anyone but the user and thus cannot be read when called upon.

It is usually reviewed as good or excellent, though some critical remarks can be made. For example, several clearly adult sites remain unrated and also it would be better if WOT should rate sponsored search results.

Some also think that WOT may be viewed as biased due to its dependency from the actual user ratings, but they claim that the latest developments in balancing the user opinion in order to provide relevant information point to the contrary.

It reports all tracking packages detected, and whether it has blocked them or not, in a temporary purple overlay box at the bottom right of the screen. From there, you can unblock/reblock everything, make exceptions, and also update a whitelist.

4.4 BetterPrivacy

After installing it, it pops up a page where you can select what you actually want it to block: 

Tracker: you can choose amongst analysis, beacons, widgets, advertisements and privacy trackers



Cookie: you can block analysis, beacons, widgets, and advertisements cookies

Elective C.N. WAS, 2014/2015

BetterPrivacy is a Firefox add-on that is able to delete a special kind of cookies: Local Shared Objects in short LSO's (usually known as Flash-cookies) are placed on your computer by a Flash plug-in.

Since Flash is a seperate application, running on your system (not under the hood of Firefox), there is technically no way to prevent it from storing those LSO's on your disk. However they can be deleted at any time, but most browsers are still unable to display or manage them. BetterPrivacy can help here and offers functionalities to list and manage stored LSO's, even providing full automatic cleaning, while allowing to define LSO-removal exclusion rules.

In both sections you can also select specific things that you want to block.

4.3 WOT WOT (Web Of Trust) is a partly crowdsourced Internet reputation tool. It shows its users the reputations of websites, which are calculated through a combination of user ratings and data from other sources. To generate revenue WOT licenses the use of its reputation database to other businesses.

After being installed, BetterPrivacy tries to find the folder where your Flash plug-in stores the LSOs (this could cause the first start of Firefox to be delayed for some seconds). Then, BetterPrivacy does absolutely nothing until you quit the browser: at that time, the add-on will look in the LSO folder, and if it finds cookies, a popup will be shown. BetterPrivacy asks if you would like to delete the LSO's at that time. You might decide to review every single LSO later at the

According to the company information the WOT software computes the measure of trust the rating users have in websites, combined with data from among others Google Safe Browsing.

9

Di Matteo Valerio 1379412

Browser Security

Elective C.N. WAS, 2014/2015

next Firefox session. Otherwise, you can choose to delete once or even to automatically delete on every Firefox exit.

web page may rely on an advertisement so the user is forced to block the add-on for the needed interval of time in order to access that page.

4.5 Adblock Plus

Also Ghostery can be considered as transparent as it only appears as a small icon on the right that counts the trackers that are being blocked, but being those related mainly to advertisement purposes, the user won’t see any change in the contents that he needs.

Sometimes they are even invisible web bugs, so their removal doesn’t affect the experience at all. It is possible that Ghostery doesn’t have to actually block anything in most cases, because with Adblock being active and with the third-party cookies being blocked in the option settings, it is hard for a tracker to actually “make it” to the browser.

Adblock Plus (ABP) is an open-source contentfiltering and ad blocking extension for Mozilla Firefox (including Firefox for mobile), Google Chrome, Internet Explorer, Opera, Safari, and Yandex Browser web browsers.

The extension allows users to prevent page elements, such as advertisements, from being downloaded and displayed. Compared to the original Adblock extension, the following features are incorporated: 

whitelisting



support for blocking background images



subscription to filters with a fixed address and automatic updates



ability to hide HTML elements, allowing a greater range of images to be blocked



ability to hide ads on a per-site basis, instead of globally



memory leak fixes



improvements to the user interface

NoScript is definitely the most invasive of the addons, as its main rule is to block them all, and then the user can make exceptions if needed. Sometimes it could happen that a website doesn’t work because often, they rely on scripts to build their pages, even if in a completely honest way, so in those cases the user has to allow those scripts. Being it a one-time only thing, however it shouldn’t be a big issue, and the exception can be canceled at any time.

It is worth noticing how these add-ons can “overlap” on each other many times. For instance, think about how Adblock Plus blocks any advertisement banner: as a consequence, some tracker can be blocked and Ghostery won’t need to detect it. Also, advertisements blocked by ABP could contain web bugs, or malicious XSS scripts, so ABP would do part of NoScript’s job, too. Even “simple” options like “block third party cookies” can do the job that plug-ins would do otherwise. This, clearly, is not an issue, because it means that we are more secure as more technologies are actively protecting our browser at the same time. In the following tests report, we will see how this actually happens.

4.6 User Experience By adding all of those plug-ins, the enhanced security and privacy comes at the cost of a slight loss of user experience. Users will have to enable some contents that they need but that the add-ons blocked.

BetterPrivacy, WOT, Adblock Plus nd Ghostery don’t interfere in the user experience if not to make it better.

BetterPrivacy only appears with a small window when closing the browser, that tells the user that LSOs are being removed, and then it disappears, so we can say that it is completely transparent.

4.7 Tests

WOT only manifests itself through a small icon on the right, which informs the user about the Web site level of reputation if he hovers with the mouse over it, and gives a little bit more details if it is clicked, but doesn’t interfere with the actual usage of the browser.

In order to discuss the effectiveness of such add-ons, we installed them all and surfed the web a bit to test the results. In particular, we spent some time on a few popular web portals like Facebook, Youtube and Amazon.

Adblock Plus greatly enhances the quality of the experience because it blocks all possible advertisements, whether they are banners or videos (like on youtube). The only minus side is that sometimes, when trying to access some content, that

4.7.1 Facebook Facebook is the first web site that we tested, as it is probably one if the not the most widely accessed page in the Internet today, along side Google.

10

Di Matteo Valerio 1379412

Browser Security

The first thing that we noticed was that , simply, it didn’t work, because it requires Javascript, and NoScript was blocking everything. So, we clicked on NoScript’s icon and selected “Allow facebook.com”.

The page reloaded and we could see the main tab with the notification bar, but no content at all. We clicked on the icon again and noticed that there was still something being blocked, called “akamaihd.net”.

It is, in a few words, the Content Delivery Networks for any content, picture or video on Facebook. We told NoScript to allow it, and eventually Facebook begun to work properly.

Elective C.N. WAS, 2014/2015

the website could work properly. We searched for some video, clicked on it, and also played it. We could even post comments without any problem.

Adblock blocked a tons of things in this case as well.

What users will mostly realize is that now, no ads are played before or during the videos, which is a great thing.

Ghostery blocked one content, namely DoubleClick, something related to advertisement banners. WOT declares YouTube’s reputation to be excellent.

4.7.3 Amazon For a third test we navigated to amazon.com.

We also noticed that, apart from Facebook’s own sponsored pages, there were no advertising banners.

By clicking on the Adblock icon, we could open up a list of blocked contents and there were dozens of pictures, media, hidden stuff and XML requests listed. So Adblock did its work properly.

At a first glance, everything seemed fine, and in fact we could surf the website properly even though NoScript was blocking a few scripts. We tried to look for some men clothes trough the search bar and everything went fine. We also tried to open a few items and it worked properly. Again, Adblock blocked a lot of contents, mostly pictures about products that were being advertised.

WOT stated that Facebook had an excellent reputation, and Ghostery didn’t find any tracker, most probably because we set in the options to block any third-party cookie and Adblock disallowed all the advertisement banners.

Ghostery didn’t have to block anything (the blocked cookies and Adblock did probably all the job) and the reputation, according to WOT, was excellent.

4.7.2 Youtube We then went on to visit youtube. Apparently, NoScript blocked many scripts from execution, but

11