Is the auth protocol completely unknown? Is the activex control obfuscated more than is possible to reverse-engineer?
Firefox is designed to be secure and sand-boxed, especially its plugin architecture.
So the question is, if you are willing to ignore their activex and run your own custom JS instead, could these websites be made to work?
And guess what happened?
Major credit card companies pulled out one by one, because they "cannot ensure" that a page without Active-X is secure enough. Of course nobody's pulling any strings, no government officials are receiving unknown gifts, and nothing can be ever proved. So, there. You work for months to provide users with modern browsing experience, and those banking powers-that-be just pull the plug.
The whole system is corrupt beyond imagination.
Citation (sorry, in Korean): http://www.hankyung.com/news/app/newsview.php?aid=2013091203... http://www.leejeonghwan.com/media/archives/002331.html
There's a reason Mozilla's addon repository has a review process.
What makes addons better than ActiveX controls is that they're understood to extend the browser for the user's benefit, not merely make a crappy website work. Fewer people would buy that a bank website needs to install a Firefox extension before you can log in.
http://www.adamlock.com/mozilla/plugin.htm
One could guess that it was never included by default because Mozilla did not want to encourage the use of ActiveX controls.
What I meant is either reverse-engineering the algorithm and reimplementing it in FF chrome in clean JS like jlgreco mentioned below, or including just the kernel of the important logic, the way ndiswrapper uses windows driver for communicating to the network cards without actually implementing whole windows kernel.