Re: Removing Firefox Version Number

On Aug 17, 4:49 pm, André Neves <[email protected]> wrote:
> On Wed, Aug 17, 2011 at 4:29 PM, Kai Engert wrote:
> > If you remove the version number from this dialog, you are unable to
> > notice that your connection to the update server is being blocked.
>
> You can notice it by looking at the Help>Troubleshoot dialog/window
> instead of looking at the Help>About.


Yes, you could, but most users wouldn't!
Most users would simply stop at the about dialog, and believe the lie
"is up to date".


> But if there is a MITM attack, the attacker can merely redirect
> updates and feed your FF with a phony update; you will see the
> expected version number and you will trust the new but
> tampered/doctored version.


Blocking an update and making use of an unfixed exploit is much easier
than developing a malicious update and convincing Firefox into
accepting it as a valid update.

Kai