6

"Make your Firefox faster, safer and stable with few mouse clicks "article says that many companies installs really DANGEROUS plugins in Firefox. I love Firefox but I must admit that it is a security risk since it allows plugin installation so easily. It should at least pop-up a message like "A plugin was installed stealthy. Do you want to disable it?"

My question is (because I don't really want to uninstall Firefox) how can I make Firefox not to accept new plugins? Maybe if I delete some files I can cripple Firefox plugin system until it is not working at all - but Firefox still works. I looked in my installed plugins (indeed I have that dangerous plugin installed) and I need none of them!

8
  • 1
    I think "really DANGEROUS" is a bit over the top. I've looked where the article says and never found anything there that was dangerous or even unreasonable. Have you had problems with Firefox being compromised? It looks like the java one is the only one to consider getting rid of due to the security vulnerability. You can update java to fix that though.
    – mouche
    Jul 27, 2010 at 16:05
  • 1
    "A plugin was installed stealthy...." - can a plugin be installed stealthily? I always get a warning. Plugins are one of the best things about Firefox. TBH, if it wasn't for the plugins I'd probably be using one of the other browsers.
    – MrWhite
    Jul 27, 2010 at 16:56
  • 1
    I wouldn't trust the blog you linked either, it kind of looks like a fake site made by a PR company (a not-very-professional one)
    – MGOwen
    Jul 29, 2010 at 3:14
  • 2
    @w3d: Plug-ins, as in Flash Player, not extensions, as in Adblock Plus. They can be installed without notification by third-party software. Jul 31, 2010 at 4:27
  • 1
    @musicfreak - ah, yes, thanks for the clarification.
    – MrWhite
    Jul 31, 2010 at 8:17

4 Answers 4

3

tl;dr ok sorry my answer may not be very readable but it incorporates several original research results that I successfully used in personal scope to block new plugins, while retaining addons.

ultra short version

  • there is now a restartless extension called new plugin disabler. it will disable each new plugin on startup! (most handy)

short version (additionally):

  • you can revoke write rights, keeping only read rights, from everyone (including the user 'Everyone') for <Firefox installation dir>/plugins. This would prevent any plugins from directory-based installing (as long as an installer doesn't replace the rights), except the few four that Firefox is prepared to know about.
  • you can try setting plugin.scan.plid.all to false in about:config. This disables firefox registry-based scanning for new plugins.
  • click to play: you can make firefox ask you each time a site needs a plugin whether to activate it. In about:config set plugin.default.state to 1 (meaning "clicktoplay"), and also set plugins.click_to_play to true.

  • when using windows, for configuring directory permissions, you can use cacls with psexec (link below) for system-level access, or perhaps the permission listing on right-click properties' security tab

  • when using windows, for extra registry protection, rewoke write rights, keep read rights for HKEY_CURRENT_USER\Software\MozillaPlugins\plugin-id, HKEY_LOCAL_MACHINE\Software\MozillaPlugins\plugin-id, HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\plugin-id. you can use regedit with the tool psexec -s -i regedit.exe (or regedt32.exe).

very long version

update 2014/06

additionally to my original answer:

even more additional info:


original answer

There's actually a way to prevent some, or all, plugins from "installing" but keep addons in Firefox. The problem is that on Windows, Firefox scans for plugins on some locations. On each of these locations can reside one or more plugins.

You can control how Firefox treats each of these locations but you cannot control how it treats individual plugins if the location lists more than one. Doing this involves multiple methods. Not all are nice.

Before getting into it, it's worth to mention that there is also click to play, that will ask you to click before activating any plugin individually, if a webpage asks for any. It can be found in about:config as plugins.click_to_play. You can set it to true.

Now, first the nicer parts:

You shall go to the about:config page and filter for plugin.scan. Here, plid means a registry key location. The rest is for plugins that are handled individually.

plugin.scan.SunJRE", "1.3"
plugin.scan.Acrobat", "5.0"
plugin.scan.Quicktime", "5.0"
plugin.scan.WindowsMediaPlayer", "7.0"
plugin.scan.plid.all", true

The "1.3", etc. is the minimum version number that Firefox accepts. The recommendation is that for plugins you want to disable, set this value to 19.0. I've set it to 99.0 and it works in Firefox 18.

You can check the actual location of these plugins by the means described on Mozilla's KB. The idea is that you go to the about:plugins page to see active plugin's location. But you need to set plugin.expose_full_path to true first.

To disable all registry-based plugin location scan, set plugin.scan.plid.all to false. The actual registry key is described on another page the KB. I listed the keys later.

If you ever need to reset these about:config settings, right click on them and choose reset.

Now for the uglier part:

Firefox will look for plugins in <Firefox installation dir>/plugins. This was where plugins like Acrobat, QuickTime and Office installed themselves in my computer.

The setting that was controlling this directory was removed. That's why I choose to modify the access rights of this directory. Set the rights for all users to read-only. Then no new program will be able to write to it.

I guess you could do the same with the registry key, too. The actual registry keys are:

HKEY_CURRENT_USER\Software\MozillaPlugins\plugin-id
HKEY_LOCAL_MACHINE\Software\MozillaPlugins\plugin-id

And on 64-bit Windows:

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\plugin-id

(To set permission on a registry key, you right-click it and go for "Permissions...". You shall see it, but if don't try starting regedit with the tool psexec -s -i regedit.exe or using regedt32.exe if I recall it well.)

Just for the record, I've removed all access from the system user for the plugins dir, and Firefox didn't crash. Any new installation may, though.

For archiving purposes, I include the full url's as text here:

plugin scanning: http://kb.mozillazine.org/Plugin_scanning . registry key: https://developer.mozilla.org/en-US/docs/Adding_Extensions_using_the_Windows_Registry#Plugins . location: http://kb.mozillazine.org/Issues_related_to_plugins#Plugin_location .

I've found these articles by browsing a category page listing all kind of interesting articles: http://kb.mozillazine.org/Category:Plugins

7
  • Wow. Such a complex answer. Many Firefox users won't understand this (as they understand how dangerous Firefox and its plugin system can be). +1 for your documented answer!
    – IceCold
    Jun 20, 2014 at 16:26
  • Happy to see you find it useful! I wish it weren't this complicated. At least anyone can guess what is what she/he is dealing with in today's technology. Hoping one day Mozilla dedicates itself to a prioritize privacy and security even more, implementing and maintaining an easy and long-term fix to this. Until then, I hope the technically minded with a will to descend this path may find some pieces useful. Hopefully these will make it a step more hard to circumvent security.
    – n611x007
    Jun 20, 2014 at 16:45
  • It will be easy for Firefox to eliminate this threat. They should not accept ALL plugins in the folder but only once that have been installed via its plugin installer interface. Yes. IT IS that easy.
    – IceCold
    Jun 24, 2014 at 9:52
  • @Altar Yes doesn't seem that hard to fix does it? Wonder what keeps them. Maybe one just would need to file a bug/feature request. Is the plugin installer interface of Firefox something that's available and has a reference?
    – n611x007
    Jun 24, 2014 at 12:19
  • 1
    I mean, when you drag and drop a plug in file (xpi) into firefox. Firefox will pop-up a message to ask you if you want to install that plug in. So, firefox is AWARE that user wanted to install THAT plug in. It should be aware about plugins that ware not explicitly installed by the user.
    – IceCold
    Jun 24, 2014 at 13:29
3

To disable all of Firefox's add-ons, you have to open the browser in its Safe Mode (no relation to Windows' own Safe Mode) by clicking Start > All Programs > Mozilla Firefox > Mozilla Firefox (Safe Mode).

In the Firefox Safe Mode dialog box that appears before Firefox opens, click "Disable all add-ons" and choose the Make Changes and Restart button to run the browser with no add-ons or extensions enabled.

A quicker way is to press the Windows key (in XP, follow this by pressing R), type Firefox -safe-mode, and press Enter.

3
  • Is this answer what you are looking for? If so, please accept the question. And upvote if you want ;)
    – r0ca
    Jul 28, 2010 at 16:02
  • 1
    I think I rather aim for "how can I make Firefox not to accept anymore plugins"
    – IceCold
    Jul 29, 2010 at 2:56
  • Plugins are suggested to you. It's your own decision to install them or not. So basically, you can't just disable add-ins auto-install feature (Because there's none) in firefox
    – r0ca
    Aug 24, 2010 at 17:45
3

There is no option to disable automatic plugin installation. All the user can do to prevent against this extremely dangerous Firefox loophole is to check the plugin list every few days (which I do).

1
  • you can revoke write rights, keeping only read rights, from Everyone for <Firefox installation dir>/plugins, HKEY_CURRENT_USER\Software\MozillaPlugins\plugin-id, HKEY_LOCAL_MACHINE\Software\MozillaPlugins\plugin-id, HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\plugin-id, and set plugin.scan.plid.all to false in about:config
    – n611x007
    Jun 20, 2014 at 15:19
0

In Firefox options menu, just choose the security tab and make sure "Warn me when sites try to install add-ons" is ticked.

Not sure why or how you turned it off, but that should fix it.

Odd that Firefox allows this at all - shouldn't be an option in my opinion, though I understand why there is an exceptions list.

3
  • 2
    The plugins were installed by local software and not by web sites.
    – IceCold
    Jul 31, 2010 at 4:03
  • 1
    OK, that makes a pretty big difference. Please edit the question to make it clear that there is a difference between add-ons installed by web sites and plug-ins installed by other apps on your local computer.
    – MGOwen
    Aug 3, 2010 at 4:29
  • Well, you should look up for these definitions by yourself. I didn't invented them. They are standard. There is nothing to clarify.
    – IceCold
    Oct 11, 2010 at 20:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .