2 ms·
Chrome extensions should be signed and should prevent updates of extensions if the new version was signed by a different from the one signed the current one unt
by dogma1138 6y ago
Chrome extensions should be signed and should prevent updates of extensions if the new version was signed by a different from the one signed the current one until the user manually approves it.
- jamieweb 6y agoMost users will click straight through the approval though, like when they granted it full permissions at install. And is the signing actually effective anyway? There's very little mention of it online, and as far as I can see it isn't covered in the official guide for publishing extensions. Is it even possible to have proper signing keys stored locally or air-gapped?
- namibj 6y agoNo, just straight up refuse unless the new signing key got approved by the old one. Hard-block. Why shouldn't it?
- ocdtrekkie 6y agoThe problem is malicious actors will only buy the extension conditional on the author handing over the signing key as well.