4 ms·

xpinstall.signatures.required = false worked for me on android

by jackewiehose 7y ago

wvenable 7y ago
Yeah, this also worked for me on Android. Not sure why the downvotes.
- DennisAleynikov 7y ago
  It works on the main branch now too, so quickfix or not try to update from the play store asap (or whatever repo you use)
- Yoric 7y ago
  Probably because this workaround consists in deactivating add-on security.
  - lugg 7y ago
    Because it's not working right now..
    - tfigment 7y ago
      Worked on my 2 android devices. Did not work on windows desktop. That needed the nightly or probably this build.
      - lugg 7y ago
        Referring to plugin security.
  - solarkraft 7y ago
    And what's the problem with not having that? Does it suddenly make my installed extensions insecure? I (somewhat) get it for the standard windows user who gives admin rights to everything, but I think this crowd is a bit more aware of what they install.
  - curiousgal 7y ago
    I haven't installed an add-on in years.
    - klez 7y ago
      Then you're not affected. What's the matter?
      - chronogram 7y ago
        That means: the installation is a while old, installation security is not useful now because the add-ons were installed ages ago, but using them is.
        curiousgal 7y ago
        Precisely.
  - rndgermandude 7y ago
    No, it does not. David, this is just wrong. Existing add-ons do not become suddenly insecure. What it does is allow you to install add-ons not signed by mozilla. Essentially the same thing as installing software not originating from the iOS and/or Mac AppStore, or the Ubuntu/Fedora/etc distro repositories, or the Windows Store, or the Play Store. The signing stuff might protect some less tech-savvy users from installing "You need this codec to play this porn video" malware add-ons, same as the other walled gardens I listed do too (tho most I listed have still a door in the wall that you can unlock and open yourself, unlike Firefox Desktop). But that's it. It is a "seal of approval" scheme saying that mozilla reviewers decided something is secure enough and has an OK quality (and wasn't forced to remove by US laws/authorities courts yet), implemented using DRM. It reduces the chances that users will install something malicious by accident/incompetence. If users still run their add-ons from AMO, then there is no difference. Unless a bad actor can either MITM AMO connections or compromise the AMO servers. At which point the users has a lot more problems already than potentially malicious browser add-ons.
  - yellowapple 7y ago
    Last I checked Firefox still gives at least a warning + confirmation dialog if you try to install an unsigned / improperly signed extension with xpinstall.signatures.required = false, no?
- jopsen 7y ago
  You're better off waiting a few more hours that disabling important security features.
  - feanaro 7y ago
    We've lived without the walled garden for more than 10 years, I'm sure we can manage a few more days.
  - jackewiehose 7y ago
    Disabling all add-ons doesn't help security either. So far I have neither an update on ubuntu-desktop nor on android (with default package managers) so without this option I'm supposed to use the internet without adblock & umatrix? lol no thx
  - deadbunny 7y ago
    Disabling noscript is a bigger security issue.
    - AstralStorm 7y ago
      It only got disabled if you installed the version from addons.mozilla.org and not the noscript.net. Some sort of pinning mechanism would be nice though without having to rely on manual installs and signing. It's a trade-off, you could end up with a version having a gaping security hole.
  - userbinator 7y ago
    The only "security" it provided was to prevent people from installing add-ons that Mozilla didn't approve of, ostensibly ones it thinks are malicious, and I'd bet that on Android (which has its own app isolation features anyway) that's even less of a problem.
    - AstralStorm 7y ago
      Not exactly. You can install add-ons from outside of Mozilla add-ons site. The extra certificate is more of Mozilla's seal of approval. This is why quite a few of my add-ons were not disabled - they were installed with trust from another site and this intermediate certificate was never in chain. You could even manually sign these add-ons you trust with custom imported CA key for your personal or corporare vetting.
eps 7y ago
This did NOT work for me with the Windows version. Had to install that .xpi from the previous HN thread on the subject.

xpinstall.signatures.required = false worked for me on android

wvenable 7y ago

Yeah, this also worked for me on Android. Not sure why the downvotes.

DennisAleynikov 7y ago
It works on the main branch now too, so quickfix or not try to update from the play store asap (or whatever repo you use)
Yoric 7y ago
Probably because this workaround consists in deactivating add-on security.
- lugg 7y ago
  Because it's not working right now..
  - tfigment 7y ago
    Worked on my 2 android devices. Did not work on windows desktop. That needed the nightly or probably this build.
    - lugg 7y ago
      Referring to plugin security.
- solarkraft 7y ago
  And what's the problem with not having that? Does it suddenly make my installed extensions insecure? I (somewhat) get it for the standard windows user who gives admin rights to everything, but I think this crowd is a bit more aware of what they install.
- curiousgal 7y ago
  I haven't installed an add-on in years.
  - klez 7y ago
    Then you're not affected. What's the matter?
    - chronogram 7y ago
      That means: the installation is a while old, installation security is not useful now because the add-ons were installed ages ago, but using them is.
      - curiousgal 7y ago
        Precisely.
- rndgermandude 7y ago
  No, it does not. David, this is just wrong. Existing add-ons do not become suddenly insecure. What it does is allow you to install add-ons not signed by mozilla. Essentially the same thing as installing software not originating from the iOS and/or Mac AppStore, or the Ubuntu/Fedora/etc distro repositories, or the Windows Store, or the Play Store. The signing stuff might protect some less tech-savvy users from installing "You need this codec to play this porn video" malware add-ons, same as the other walled gardens I listed do too (tho most I listed have still a door in the wall that you can unlock and open yourself, unlike Firefox Desktop). But that's it. It is a "seal of approval" scheme saying that mozilla reviewers decided something is secure enough and has an OK quality (and wasn't forced to remove by US laws/authorities courts yet), implemented using DRM. It reduces the chances that users will install something malicious by accident/incompetence. If users still run their add-ons from AMO, then there is no difference. Unless a bad actor can either MITM AMO connections or compromise the AMO servers. At which point the users has a lot more problems already than potentially malicious browser add-ons.
- yellowapple 7y ago
  Last I checked Firefox still gives at least a warning + confirmation dialog if you try to install an unsigned / improperly signed extension with xpinstall.signatures.required = false, no?
jopsen 7y ago
You're better off waiting a few more hours that disabling important security features.
- feanaro 7y ago
  We've lived without the walled garden for more than 10 years, I'm sure we can manage a few more days.
- jackewiehose 7y ago
  Disabling all add-ons doesn't help security either. So far I have neither an update on ubuntu-desktop nor on android (with default package managers) so without this option I'm supposed to use the internet without adblock & umatrix? lol no thx
- deadbunny 7y ago
  Disabling noscript is a bigger security issue.
  - AstralStorm 7y ago
    It only got disabled if you installed the version from addons.mozilla.org and not the noscript.net. Some sort of pinning mechanism would be nice though without having to rely on manual installs and signing. It's a trade-off, you could end up with a version having a gaping security hole.
- userbinator 7y ago
  The only "security" it provided was to prevent people from installing add-ons that Mozilla didn't approve of, ostensibly ones it thinks are malicious, and I'd bet that on Android (which has its own app isolation features anyway) that's even less of a problem.
  - AstralStorm 7y ago
    Not exactly. You can install add-ons from outside of Mozilla add-ons site. The extra certificate is more of Mozilla's seal of approval. This is why quite a few of my add-ons were not disabled - they were installed with trust from another site and this intermediate certificate was never in chain. You could even manually sign these add-ons you trust with custom imported CA key for your personal or corporare vetting.

eps 7y ago

This did NOT work for me with the Windows version. Had to install that .xpi from the previous HN thread on the subject.