Mozilla's New VP Will Focus On Privacy & Security

Mozilla has a new security chief who will focus on privacy and security. Alan Davidson is the new vice president for "Policy, Trust and Security" with the open source developer. He will be responsible for promoting an open internet and a 'healthy web'.

He will also lead a 'trust and security' team that will focus on promoting innovative privacy and security features in Mozilla products. Previously, Davidson worked at the US Department of Commerce and in 2011 he was the policy leader at Google. "I am very happy to work for an organization that is so dedicated to putting the user first", Davidson said.

Mozilla Doubles Donations To The Tor Project

The Tor Project has today launched a crowdfunding campaign to raise funds and Mozilla will double donations to a total of $ 500,000. Every day, 2 million people use the Tor network to protect their privacy and visit censored websites.

According to the Tor Project, the number of online attacks on censorship and privacy was unprecedented this year. "Countries around the world tried to restrict access to the web, to dissolve dissidents and to compromise personal privacy," said Tommy Collison of the Tor Project. Also for next year, the Tor Project expects many governments and companies censorship to make the norm and want privacy to be included in the past.

A large part of the revenue from the Tor Project comes from the US government and the organization wants to reduce it by depending more on individual donations. As there are no restrictions on crowdfunding, the money that is collected can be spent on projects which, according to the Tor Project, are the most important and can be responded quickly to changing circumstances.

Furthermore, the Tor Project praises cooperation with Mozilla. Not only will Mozilla double donations to a total of $ 500,000, both parties will work closely together in software development. For example, there is regular consultation between the engineers of Mozilla and the Tor Project. For example, Tor Browser's privacy enhancements are added to Firefox, and Mozilla engineers have taught Tor developers to program in the Rust programming language. In addition, Mozilla helps the Tor network by running several Tor servers.

Mozilla Adopts Proposal For Blocking Online Content

The blocking of online content, and particularly ads and trackers already done a lot on the desktop, but with the arrival of iOS also ninth in the mobile ecosystem on the rise. The reason for Mozilla to present a proposal to block online content.

"Blocking content will not disappear, it is now a part of our online experience. But the landscape is not well understood, making it difficult to see how we can foster an open and healthy web," said Mozilla's DENELLE Dixon Thayer. According to her, let the increasing availability and use of content blockers show that users want their online experience.

"This is a good development. But the blocking some content can be harmful without it being immediately clear", says she.This concerns for example content blockers who will determine which content is or is not being displayed. This may ultimately harm innovation and competition. In the long term, users can also lose just as much control as they win, warns Dixon Thayer.

Mozilla therefore has three principles for content blocking proposed. Firstly, content blockers focus on the needs of users, rather than to block specific content, such as advertisements. In addition, content blockers should be transparent in front of users and give them control. The last principle Mozilla advocates openness. Blocking should provide a level playing field, regardless of the origin of the content. This last principle focuses on certain adblockers who continue to allow ads from certain parties.

China Censor Messages On Google And Mozilla CNNIC

The Chinese authorities have messages from Google and Mozilla censored stating that Chinese certificate authority (CA) CNNIC has been involved in the issue of rogue Google certificate. Reported GreatFire.org , an organization that monitors censorship in China.

The rogue Google certificate which Google, Microsoft and Mozilla this week sounded the alarm had been created by the Egyptian company MCS Holding. The company had been given the opportunity of CNNIC, which is a root CA. As root CA is CNNIC trusted by all major browsers. CNNIC had spent an intermediate certificate for MCS Holding, which the company for arbitrary domains could create SSL certificates. Because the intermediate certificate of CNNIC came, they were created SSL certificates also trusted by browsers.

Both Mozilla and Google warned of rogue certificates and announced measures to protect their users. A famous Chinese IT blogger translated the message from Google that both Google and the Chinese search engine Baidu was well indexed. Not much later, the blogger via Twitter announced that he had received a call from the government that he had to remove his post immediately, which he did. The article Mozilla was acquired by several Chinese sites, including the state-owned Huanqiu.

Eventually, all these articles deleted. "This shows again the role CNNIC in the censorship apparatus. CNNIC was, is and will continue to internet censorship," said Great Fire. The organization calls Google, Mozilla, Microsoft and Apple also to say and draw the root certificate from the organization's confidence in CNNIC to protect users worldwide.

Mozilla Launches Memory Scanner For Servers

Mozilla has released a tool that allows for real-time scan the memory of a great number of servers on any suspicious items. The open source developer manages thousands of servers for the development of products and offering services.

Developed to monitor the security of these servers was the Mozilla Investigator (MIG). MIG can the file system and network information on thousands of machines simultaneously monitors, which should provide more insight into the infrastructure.Until recently, however, it was not possible to isolate MIG to analyze the memory of running processes. Yet it would be for security investigation.

Masche

In recent months developed several students why a "memory forensics library" on Linux, Mac OS and Windows is running. Masche , as the tool is called, can scan the memory of running processes, without having impact on the system. It does not offer the same detail as advanced forensic software, but is focusing on " regexes "and" byte strings "in the processes of many systems.

This makes it possible to monitor the memory of such systems quickly and in real-time. The source code of Masche is completely open source and available on Github . Mozilla tool will integrate within MIG and deploy within their own infrastructure. This should ultimately improve scanning performance of the tool, which in turn Mozilla will share with the community.

Firefox Probably Get Automatic Repair Function

Mozilla is working on an experimental system that Firefox soon own problems in the browser can notice to remedy that then automatically and proactively. This relates for example to a hijacked or custom search engine that will restore the original state browser.

Possibly Firefox are recovering the impact of undesirable or unwanted add-ons automatically. The new measure is called "Self Heal" and was last week during a meeting called between Firefox Developers (from minute 6:00 ). The discussion prior to Self Heal was about the signing of Firefox add-ons, which should mitigate the inconvenience of malicious browser extensions.Through Self Heal could be extended further.

Meanwhile, Mozilla also announced the availability of a " Self-Repair server "is announced, which should ensure that found Firefox can repair problems yourself. However, further details are still missing, and whether and when the function will be implemented exactly. To counter the nuisance of malicious add-ons and malware Google added two years ago, a reset button to Chrome to which recovers all kinds of custom settings in original state.

Mozilla Removes Superfish Certificate From Firefox

For Firefox users against Man-in-the-middle attacks to protect Mozilla has decided to remove the Superfish certificate from the browser, but only when users first have the controversial program their computers have been removed. Superfish installed on computers a root certificate that could intercept SSL traffic and then inject ads.

However, the adware found to contain a vulnerability whereby users could be attacked. Several parties, including Lenovo, came with removal tools to remove both Superfish Superfish if the installed certificate. Some of these tools do not remove remove the Superfish certificate from Firefox, allowing these users are still at risk of being attacked.

To ensure that these users are still safe Mozilla started rolling out a hotfix . This hotfix checks whether Superfish is removed and then remove the Superfish certificate from Firefox. If Superfish namely still on the computer and Mozilla would remove the certificate from Firefox, users would no longer be able to visit HTTPS sites. The browser developer advises users therefore to the removal instructions to follow Lenovo, which both the software and the certificate can be removed manually

Mozilla Is Considering Blacklist For Superfish Certificate

Mozilla is considering to put the Superfish certificate was installed on laptops from Lenovo on a blacklist.According to a discussion on Mozilla's Bugzilla where developers discuss issues and bugs in Mozilla software. By putting the certificate on a blacklist would user certificate warnings that are displayed when using the Superfish certificate can not ignore.

Through the root certificate that installs Superfish on the root store of computers, where all root certificates are stored, SSL connections can be intercepted. Superfish late because all SSL connections run through its own certificate. Researchers managed to crack the password using the private key of the Superfish certificate. This makes it possible in some cases to Man-in-the-middle attacks against systems that perform Superfish and certificate are active.

"Every certificate that is added to root stores by commonly used software and whose private key is known, is a risk," said Gervase Markham on Bugzilla. He notes that the behavior of software installation certificates or not install on computers can change. A program can one week show no suspicious behavior and that a week later do it again. "Without extensive research, we do not know exactly how they work, and in what cases can modify software root lists and also what root lists."

Although Mozilla employees were initially quite hesitant to put the certificate on the blacklist, the decision by Microsoft to the Superfish application and the certificate by using Windows Defender and Security Essentials to remove changed this. "This paves the way for us free to revoke the certificate," said Mozilla's Richard Barnes . Since Microsoft already has the certificate on many computers removed the impact of any blacklisting will therefore be easy. "It just adds to the disinfection," Barnes continues. However, if and when the certificate on the blacklist will not yet decided.

EFF Also Not Happy With YouTube Without Flash Player

In late January announced that Google's now standard HTML5 for video playback, so users do not have Adobe Flash Player need more, but according to the American civil rights movement EFF this is not a victory or improvement for Internet users.

The Electronic Frontier Foundation (EFF) is also not in favor of Adobe Flash Player, which it describes as a closed technology where regular vulnerabilities are found in exposing millions of users to attack. Switching to HTML5 seems at first sight, therefore an improvement, but it is anything but that, late science fiction writer, journalist and blogger Cory Doctorow know.

The problem is that to play Youtube videos without Flash Player Encrypted Media Extension (EME) is used. According Doctorow a controversial technology that Apple, Microsoft and Google, after consultation with Netflix agreed upon. In the spring of 2013 decided the World Wide Web Consortium (W3C) is behind to rally the extension. Last May, Mozilla joined here. According to the browser developer would be no support for Netflix users lose other browser vendors. To the annoyance of Doctorow, who likens it to "destroy the village to save it."

In the case of YouTube is it now means that users without Adobe Flash Player to view videos. "As long as your browser supports the W3C version of Adobe's proprietary software," says Doctorow. Firefox Users can view all the Youtube videos without Flash, but will in some cases require standardized by W3C Encrypted Media Extension. But who uses proprietary software from Adobe, including Mozilla announced last year. According Doctorow is therefore ultimately nothing changed.

Crypto Stick For Secure Login And Encryption Is Now Called Nitrokey

The Crypto Stick, a USB stick with which Internet users can log in and secured files and email can encrypt, has been given a new name, namely Nitrokey . The new name should reflect the development of the stick, which is now finally ready for consumers.

The secret keys Nitrokey used to encrypt or sign located on the USB stick. According to the developers, it is impossible to extract these secret keys Nitrokey, making the device would be immune to viruses and Trojans. Furthermore, the PIN that the user must choose and the "do not manipulate the" smart card to ensure that the Nitrokey in case of theft or loss is still protected. Both the hardware and software Nitrokey are both open source.

The USB stick can be used for various purposes, such as secure login via a One Time Password for example Google or Dropbox, email encryption based on S / MIME and OpenPGP, encrypting files and hard drives and user authentication on both local computers as networks. Mozilla uses the Crypto Stick to secure its infrastructure.

The Crypto Stick is already since 2008 as "hobby open source project" in development. The developers say that they have learned during this time that developing a system that works is one thing, but delivering a device that is stable and ready for consumers, is a whole different story. The development of the latest version of Crypto Stick took two years to complete and is now complete. Now the system operates stably concentrate the developers at its production. Because of the new phase of the project has decided to change the name of Crypto Stick Nitrokey. "The goal is to provide the best open source securitykey to our users remains unchanged," they note