3 ms·
If it failed open, anyone unlucky enough to update their extensions could end up having a malicious version installed. It also would have taken longer to notice
by stevenwliao 7y ago
If it failed open, anyone unlucky enough to update their extensions could end up having a malicious version installed. It also would have taken longer to notice.
- tedunangst 7y agoUpdating with an expired cert doesn't automatically result in compromise.
- Thorrez 7y agoYes, but what's the point of cert expiration? Is it safe to have certs that never expire? I believe there is a security benefit to expiration. Expiration is useless if it's never enforced. Probably the correct behavior is to have some sort of semi-annoying popup when it expires, and then only a week later do the full blocking. You need to strike the right balance of making it annoying enough that it can't be ignored by everyone (otherwise you just have the exact same problem, just delayed a week) and that fear of it happening is a sufficient motivator to stop people lazily relying on the grace period, but also not too annoying that it makes a lot of people quit. You also want to avoid permission fatigue.
- Causality1 7y agoSo why not just disable extension updates instead of disabling the extensions themselves?
- anfilt 7y agobecause that would make too much sense.
- ssadler 7y agoPresumably because how would it differentiate between a legit "already installed" extension with a signature that cannot be verified, and an extension installed by malware that also cannot be verified?
- Causality1 7y agoPersonally I despise the idea of the software already on my pc being dependent on signatures stored on a remote server. I installed it and Mozilla can fuck right off. It's my responsibility to police what software is on my computer, not theirs.
- cesarb 7y agoAccording to https://news.ycombinator.com/item?id=19824520 https://news.ycombinator.com/item?id=19824520 the signatures are on the extensions themselves, not on a remote server.
- Thorrez 7y agoBrowsers can only protect against malicious websites and malicious extensions. They can't protect against malware. Even without any cert problems, malware on your machine can modify the browser executable/process to insert whatever code it wants. With this reduced threat model, it's easy to simply keep existing pre-installed extensions available, and disable updates. Your only problem is if a pre-installed extension is malicious or has a vulnerability, it will remain.
- josteink 7y ago> Presumably because how would it differentiate between a legit "already installed" extension with a signature that cannot be verified, and an extension installed by malware that also cannot be verified? This is why a signature can also be accompanied by a trusted time stamp which can confirm that the signature was made while the certificate was valid. This is the common way to sign all Windows software to avoid this exact kind of problem. Yes, that implies this is a known and solved problem. It’s embarrassing for Mozilla to not have prepared for this.
- rst 7y agoIf an extension was already installed, it passed the signature check at the time of installation. I'm not sure what benefits we get from periodically re-running the exact same check -- particularly when balanced against the risks of the re-checks, which are now obvious.
- xvector 7y agoThis disables NoScript on Tor Browser. That's much worse than the slim chance of a malicious extension being installed.
- swalladge 7y agoIt should fail 'locked'. continue to allow installed addons to work, notify the user of issue, disable any updates without explicit request by the user.