6 ms·

> It could be a feature that can only be enabled from the browser UI, with appropriate warnings That's not the issue. The problem is: where do you record the f

by cesarb 7y ago

> It could be a feature that can only be enabled from the browser UI, with appropriate warnings That's not the issue. The problem is: where do you record the fact that the user has seen and acknowledged these warnings? Wherever it is, malware can go there and write "yes, the user has already seen the warnings, no need to ask them, you can run the extension".

dessant 7y ago
You request administrative rights to store the configuration change. With root access malware can just replace Firefox. Even with signature checks enabled malware can trick users by pointing Firefox shortcuts to a patched browser, changing shortcuts doesn't require root access.
Groxx 7y ago
Why not in the OS's keyring?
mirimir 7y ago
But here's the thing: It's my browser, not Mozilla's.
Thorrez 7y ago
Once there's malware on the system you've completely lost, there's nothing Firefox can do ever, so there's no point in trying to provide any protection in that case.
- bzbarsky 7y ago
  That depends. If the malware (and to be clear, "malware" here includes various anti-virus vendors and other gray-hat software that is nominally providing the user a service but _also_ attempting to insert itself into Firefox) is only running with the privileges of the user, it can't modify the Firefox install itself, if that install requires administrator access (sudo on Linux, etc) to modify. That gives you a trusted place to bootstrap from. The addon database is stored in the user's profile, so _can_ be edited by such malware, but that's where the the trusted code could try to verify integrity in some way. Which is how we got where we are now. Disclaimer: I work on Gecko, not extensions and the "things injecting into the browser" situation, but have overheard a bunch of discussions about it.
  - gruez 7y ago
    >[...] is only running with the privileges of the user, it can't modify the Firefox install itself It can however, attach to Firefox as a debugger and modify it's code as needed (ptrace/writeprocessmemory).
    - bzbarsky 7y ago
      Attaching as a debugger may require elevated privileges too (e.g. on Mac).
  - Thorrez 7y ago
    Couldn't the malware replace your Firefox icon with a version that points to a malicious patched Firefox? Or whenever it sees Firefox start, it kills it it and starts the malicious Firefox instead.
    - proto-n 7y ago
      Mozilla's reasoning is that these programs like to think of themselves as not malware. Configuring the user's computer is much easier to claim as "honest behavior" than patching or replacing executables.
user17843 7y ago
I don't understand this logic at all, it baffles me. Malware can do a lot of things, but I never heard of common software being designed under the assumption that malware has taken over the PC. The software I use is designed under the assumption that the user is intelligent enough to keep the computer malware free. Only the OS or explicit security software is designed to keep me from malware, but not my text editor, office software or browser. It is a terrible excuse for ignoring user intent. What's next? Disallowing to change the startpage from google.com because malware can change it? Disallowing downloads because users could download malware? Going that route would essentially take away the entire software in the end. Maybe at one point Firefox is only allowed to operate from within the cloud, where employees make sure it is 100% safe? Also others have already said that one could add admin privilege to certain settings.
- dessant 7y ago
  It would be important for the Firefox team to allow a discussion with third-party developers about the exact threat model and reasoning behind forcing signature checks, and disallowing an escape hatch. There are indications [1] that not even Mozilla employees have a good understanding of the threat model and the current solution, and that leaves one wondering how could alternative solutions be possibly explored if the topic isn't even properly understood. [1] https://news.ycombinator.com/item?id=20423747 https://news.ycombinator.com/item?id=20423747
  - user17843 7y ago
    Maybe no one really knows anymore why the feature was implemented that way in the first place. I think the post-mortem has shown that the biggest problem of mozilla is fragmentation of decision-making, and the existence of probably >50 small teams that do stuff without communicating. It is highly likely that the certificate problem isn't the only negative consequence, and that we'll see more evidence of mismanagement in the future. I have the feeling that for some reason mozilla has established a culture where information does not flow efficiently from top to bottom and vica versa, and it even looks like the management doesn't really exist. When a small team is formed around a task without central oversight, reporting back to someone, it will tend to justify it's existence, even if it means doing unnecessary work. I heard the last CEO who wanted to streamline the mozilla hierarchy back to efficiency was Brendan Eich and many people got uncomfortable when he started to demand that people actually work productively. I think a honest post-mortem would have come to a painful conclusion: That the Mozilla of today is in no way able to compete anymore, and many employees have stopped doing real work. The company only lives on because it lives off it's massive market-share of the past. I am convinced that, within 2 years, mozilla will be confronted with massive lay-offs, threatening the gecko engine. This incidence shows me that they haven't done anything to address their structural problems, probably because most people in the company are content with the place they have, and comfortable living off the massive google revenue.
vbezhenar 7y ago
Malware can patch or replace your firefox.exe, that's not a very strong argument, if you ask me.
- acdha 7y ago
  Okay, you’re not running as Administrator on your corporate Windows desktop. How does that malware replace Firefox.exe — not to mention setting a valid signature? The answer is why this matters: we’re not in the Windows 95 era any more and a large fraction of users are running without admin privileges, often on a system which does code signing checks. Being able to get a trusted binary to run an add-on is common because the easier direct techniques aren’t as they were a couple decades ago.
  - vbezhenar 7y ago
    First of all: user separation is not a robust mechanism. There are countless privilege escalation exploits. It's just one layer of protection. If you insist that exploit can't escalate its privileges, then set this addon running privilege from Administrator. That would be a good thing actually.
    - acdha 7y ago
      > It's just one layer of protection. Exactly, and it’s important in cases where users are being convinced to install dodgy extensions because each additional step increases the chances of someone realizing that it’s a scam.

by cesarb 7y ago

dessant 7y ago

You request administrative rights to store the configuration change. With root access malware can just replace Firefox. Even with signature checks enabled malware can trick users by pointing Firefox shortcuts to a patched browser, changing shortcuts doesn't require root access.

Groxx 7y ago

Why not in the OS's keyring?

mirimir 7y ago

But here's the thing: It's my browser, not Mozilla's.

Thorrez 7y ago

Once there's malware on the system you've completely lost, there's nothing Firefox can do ever, so there's no point in trying to provide any protection in that case.

bzbarsky 7y ago
That depends. If the malware (and to be clear, "malware" here includes various anti-virus vendors and other gray-hat software that is nominally providing the user a service but _also_ attempting to insert itself into Firefox) is only running with the privileges of the user, it can't modify the Firefox install itself, if that install requires administrator access (sudo on Linux, etc) to modify. That gives you a trusted place to bootstrap from. The addon database is stored in the user's profile, so _can_ be edited by such malware, but that's where the the trusted code could try to verify integrity in some way. Which is how we got where we are now. Disclaimer: I work on Gecko, not extensions and the "things injecting into the browser" situation, but have overheard a bunch of discussions about it.
- gruez 7y ago
  >[...] is only running with the privileges of the user, it can't modify the Firefox install itself It can however, attach to Firefox as a debugger and modify it's code as needed (ptrace/writeprocessmemory).
  - bzbarsky 7y ago
    Attaching as a debugger may require elevated privileges too (e.g. on Mac).
- Thorrez 7y ago
  Couldn't the malware replace your Firefox icon with a version that points to a malicious patched Firefox? Or whenever it sees Firefox start, it kills it it and starts the malicious Firefox instead.
  - proto-n 7y ago
    Mozilla's reasoning is that these programs like to think of themselves as not malware. Configuring the user's computer is much easier to claim as "honest behavior" than patching or replacing executables.

user17843 7y ago

I don't understand this logic at all, it baffles me. Malware can do a lot of things, but I never heard of common software being designed under the assumption that malware has taken over the PC. The software I use is designed under the assumption that the user is intelligent enough to keep the computer malware free. Only the OS or explicit security software is designed to keep me from malware, but not my text editor, office software or browser. It is a terrible excuse for ignoring user intent. What's next? Disallowing to change the startpage from google.com because malware can change it? Disallowing downloads because users could download malware? Going that route would essentially take away the entire software in the end. Maybe at one point Firefox is only allowed to operate from within the cloud, where employees make sure it is 100% safe? Also others have already said that one could add admin privilege to certain settings.

dessant 7y ago
It would be important for the Firefox team to allow a discussion with third-party developers about the exact threat model and reasoning behind forcing signature checks, and disallowing an escape hatch. There are indications [1] that not even Mozilla employees have a good understanding of the threat model and the current solution, and that leaves one wondering how could alternative solutions be possibly explored if the topic isn't even properly understood. [1] https://news.ycombinator.com/item?id=20423747 https://news.ycombinator.com/item?id=20423747
- user17843 7y ago
  Maybe no one really knows anymore why the feature was implemented that way in the first place. I think the post-mortem has shown that the biggest problem of mozilla is fragmentation of decision-making, and the existence of probably >50 small teams that do stuff without communicating. It is highly likely that the certificate problem isn't the only negative consequence, and that we'll see more evidence of mismanagement in the future. I have the feeling that for some reason mozilla has established a culture where information does not flow efficiently from top to bottom and vica versa, and it even looks like the management doesn't really exist. When a small team is formed around a task without central oversight, reporting back to someone, it will tend to justify it's existence, even if it means doing unnecessary work. I heard the last CEO who wanted to streamline the mozilla hierarchy back to efficiency was Brendan Eich and many people got uncomfortable when he started to demand that people actually work productively. I think a honest post-mortem would have come to a painful conclusion: That the Mozilla of today is in no way able to compete anymore, and many employees have stopped doing real work. The company only lives on because it lives off it's massive market-share of the past. I am convinced that, within 2 years, mozilla will be confronted with massive lay-offs, threatening the gecko engine. This incidence shows me that they haven't done anything to address their structural problems, probably because most people in the company are content with the place they have, and comfortable living off the massive google revenue.

vbezhenar 7y ago

Malware can patch or replace your firefox.exe, that's not a very strong argument, if you ask me.

acdha 7y ago
Okay, you’re not running as Administrator on your corporate Windows desktop. How does that malware replace Firefox.exe — not to mention setting a valid signature? The answer is why this matters: we’re not in the Windows 95 era any more and a large fraction of users are running without admin privileges, often on a system which does code signing checks. Being able to get a trusted binary to run an add-on is common because the easier direct techniques aren’t as they were a couple decades ago.
- vbezhenar 7y ago
  First of all: user separation is not a robust mechanism. There are countless privilege escalation exploits. It's just one layer of protection. If you insist that exploit can't escalate its privileges, then set this addon running privilege from Administrator. That would be a good thing actually.
  - acdha 7y ago
    > It's just one layer of protection. Exactly, and it’s important in cases where users are being convinced to install dodgy extensions because each additional step increases the chances of someone realizing that it’s a scam.