Screengrabbing in FireFox

On Windows PC's I use SnagIt from TechSmith for screencaptures etc. On OSX I use the built-in capabilities of OSX for capturing screens, windows, or areas, but there was something missing...

SnagIt can capture large windows within *cough*Internet Explorer*cough* or Firefox as one image. So no need for a capture, scroll down, capture again etc. This feature isn't available in OSX, or any (commercial) capturing software I could get my hands on. Until I ran into Screengrab.

Screengrab is a FireFox extension which allows you to save an entire webpage as an image (jpg or png). Excellent extension if I may say so.

Broken SSL Trust

WebTrust broken?When a CA issues a SSL certificate they (the registration authority) should verify certain information provided by the requester. This includes at least the domain name ownership and preferably the person or company tied to the domain name ownership. Basic stuff really, but what happens when certificates get issued without any verification? Well, this happened to Mozilla [2].

Basically the complete trust framework collapses (for that CA). Especially combined with hosts file and/or DNS hijacking. What if this incident isn't the first? What if some cybercrook got some SSL certs due to similar mistakes of your favorite bank? You're no longer sure if the https connection of your bank really terminates on the servers of your bank. They could just as easily terminate on a server in Russia or Albania. Which leaves you with an empty bank account (most likely).

If the certificate is issued (signed) by a Comodo Root CA (as it was in this case), your browser accepts this as a valid/trusted CA and for the user everything seems fine. This takes me back to the issue of all those trusted root certification authorities in the average OS or browser.
This time, it's a Comodo affiliate that's screwed up (there's no other way of describing this), but what are the chances that some of those trusted 100+ CA's make a mistake? The bigger the list, the bigger the chance of wrongfully issues (SSL) certificates.

By the way, if you're using an older browser (pre IE6 e.g.), chances are that SSL certificate revocation checking is disabled by default. So even when the revoke they certificate you still wouldn't know.... You can verifiy this by opening the Internet Explorer options section and checking the Advanced tab.

FireFox 3 Color Management

In the 'old' days, Safari was probably the only Internet browser with some decent color management. The problem was that images displayed in Firefox and Internet Explorer looked a bit desaturated and lighter.

Now, in FireFox 3 you have the opportunity of enabling color management. Just set the following configuration option to 'true' (by double clicking) in the FireFox configuration settings (to access the config-part of FireFox, just type about:config in the address bar).

gfx.color_management.enabled

This feature is turned off by default. Restart firefox and be amazed by the colors in your photos on the Internet

Create Your Own EV Certificate??

Most web browsers support the extended validation certificates. These certificates give a visual indication (green browserbar for example) that the SSL connection is trustworthy. The only problem is that they are expensive. Especially compared with the 'ordinary' SSL certificates.

These certificates are special because the Certificate Authority (e.g. VeriSign) validated the company who buys these certificates. This way, the end user can shop / bank / or whatever online without worrying too much.

Some affiliates / certificate vendors already did this years ago (validating the actual companies), so this is nothing new. Yet another way to fool the consumers, and make some extra money.....

The problem I run into is that I used to have a 'yellow-ish' addressbar when I entered an https website. Today (at least with FireFox 3) the address bar remains blank. The only indication is a tiny lock displayed at the bottom of the browser. Something you might (and definitely will) overlook.

I use a home made Certificate Authority to create my own certificates (for webmail, secure IMAP, SSL, etc.), but I would like to see a proper visual indication of the SSL connection. So, is there a way to create an EV-like certificate (or even a new CA) by using Microsoft Certificate Services or by using OpenSSL which displayes the colored addressbar?

I did find some info on the EV requirements, but these should be 'spoofable' some way or another.....

UPDATE: I found a website which suggests reconfiguring Firefox 3. Problem with that is that I need to reconfigure all my browsers. I'd rather do it by 'faking' the specs.

It seems that the OCSP-responder is mandatory for the bars to turn green....

FireFox 3 Bug??

Like most security conscious people I use Firefox (FF) for my everyday browsing on the Internets. So when the Mozilla guys released version 3 I installed it on all my machines (2 Windows and 2 OSX platforms).

It was a bit getting used to. The underlying FF part had been changed. Bookmarks, history etc are all stored in sqlite databases. So no more flatfiles. This took me a couple of hours to figure it out, but finally I got 'there'.

Using FF was business as usual... Apart from one very annoying bug; Opening new windows (not new tabs) results often in an empty bookmarks bar. And this is happening on Windows and OSX versions of FF.
The bookmarks are 'there' but not click-able. Using the right mouse button (on OSX: ctrl-mouse click) on the bookmarks bar and selecting 'Open All in Tabs', FF opens every bookmark in the bar.

The only way of restoring the proper bar is the completely shutdown FF and restart it. After that it works for a certain amount of time.

The problem isn't isolated to my environment. Just google on the issue, and you'll find more people. There's one suggestion I haven't tried yet. Starting with a fresh/clean profile, but I do need my settings/passwords/bookmarks. I'm lost without those :(

UPDATE: I tried a new profile, and this seemed to work. After this I started to repopulate the new profile with the old settings, etc. Everything went fine until the point where I added the extensions. It seems that even old / not active extensions (SwitchProxy in my case) are still able to f*ck things up.

FireFox 3 Dialog Boxes

Firefox is the default browser on all my platform, and every once in a while I run into strange dialog boxes.
E.g., this evening I updated some digital certificates for the test environment of VeriSign MPKI backend. These certificates are issued by a (private) VeriSign CA. So there's no trust by default.

After generating the keypair in FireFox 3 I got the positive dialog box as showed below.

No problem so far, but the next dialog box 'scared' me a little;

This dialog box, or at least the result, would remove (or delete) the certificate I just generated. The issueing CA is not installed in FireFox (or on the machine itself for all it matters). But in fact the certificate was installed in the Crypto/Certificate store of FireFox, and I could use it to access the VeriSign test backend.

So, eventhough, FireFox warns the user that the content will be deleted (or not added), it doesn't exactly does that at all. Let's see if I can file a bug report, because this occured on all 4 certificates I generated/imported.