Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

All extensions disabled due to expiration of intermediate signing cert

bugzilla.mozilla.org

Post reply on HN
Print view View original

251–260 of 955 posts

Re: All extensions disabled due to expiration of intermediate signing cert

#251

Post by hnaccy »

mrep wrote: post #225
Chirael wrote: post #143

Just discovered the same message in the Tor browser, and it seems that NoScript got disabled. So people running Tor are a lot more vulnerable right now. Also, wow, the web has a ton of ads. I've been running uBlock origin so long I forgot how bad it had gotten :(

> Also, wow, the web has a ton of ads. I've been running uBlock origin so long I forgot how bad it had gotten :( Try turning it off. I got rid of ublock after arstechnica complained about a lot of their users blocking ads years ago and it honestly isn't that bad. Every once in a while I do back out of a page for maxing out one of my cpu cores but otherwise, nothing ever bad happens. With ads: either it takes me half…

>nothing ever bad happens. With ads: either it takes me half a second to tell I'm not interested in an ad, or I actually am interested and i follow the ad because I am interested and I want to support the website.

You just described something bad.

Re: All extensions disabled due to expiration of intermediate signing cert

#253

Post by luckylion »

steve19 wrote: post #70
driverdan wrote: post #61

Earlier quoted context omitted.

I'm generally not a fan of firing people for making mistakes. This one is so monumental it may require it though. This breaks most FF installations.

You didn't answer my question. What does firing achieve? You fire a person who learnt their lesson and will never make the mistake again? And then hire someone new? Or you fire the scapegoat because of a broken system that allowed one person to make a mistake?

> You fire a person who learnt their lesson and will never make the mistake again?

That's true, sort of. How often do you let people make huge mistakes before you decide that maybe they are just not apt for the position that they've been promoted to and Peter was right? Once? Twice? And unlimited amount, as long as it's never the exact same mistake?

Re: All extensions disabled due to expiration of intermediate signing cert

#254

Post by MrStonedOne »

SomeHacker44 wrote: post #85
kam wrote: post #25

Earlier quoted context omitted.

ACME / Let's Encrypt go in the direction of making expiry happen so often that renewal gets automated, rather than a being a rare manual process that can be forgotten about. Not sure that's viable for a signing certificate like this, but that's the way to solve it for the web PKI.

This is just abusive to the vast majority of users who do not care but still want to use SSL for their servers, frankly. I should be allowed to choose a near unlimited lifetime for my server's certificate if I don't care about the risks that may present.

It's not your risk to decide on. You will not always own that domain name, and allowing you to still have a valid cert for it afterwards is silly.

Re: All extensions disabled due to expiration of intermediate signing cert

#255

Post by anfilt »

Causality1 wrote: post #179
stevenwliao wrote: post #36

Earlier quoted context omitted.

If it failed open, anyone unlucky enough to update their extensions could end up having a malicious version installed. It also would have taken longer to notice.

So why not just disable extension updates instead of disabling the extensions themselves?

because that would make too much sense.

Re: All extensions disabled due to expiration of intermediate signing cert

#256

Post by drewmol »

pepa65 wrote: post #232
gpm wrote: post #227

To re-enable all disabled non-system addons you can do the following. I am not responsible if this fucks up your install: Open the browser console by hitting ctrl-shift-j Copy and paste the following code, hit enter. Until mozilla fixes the problem you will need to redo this once every 24 hours: // Re-enable *all* extensions async function set_addons_as_signed() { Components.utils.import("resource://gre/modules/addon…

I just set xpinstall.signatures.required to True in about:config and that fixed it after a restart.

For me this is False ;-)

Re: All extensions disabled due to expiration of intermediate signing cert

#257

Post by MrStonedOne »

Godel_unicode wrote: post #157
tty2300 wrote: post #108

Earlier quoted context omitted.

Its also more secure. Long lived certs risk the possibility that someone who used to own the domain got a certificate on it and it still works after the domain is resold. Once you automate it there is no downside to short lived certs.

If only there were a way to revoke certificates. Like, some kind of list.

Revocation requires the private key

Re: All extensions disabled due to expiration of intermediate signing cert

#258

Post by userbinator »

gpm wrote: post #227

To re-enable all disabled non-system addons you can do the following. I am not responsible if this fucks up your install: Open the browser console by hitting ctrl-shift-j Copy and paste the following code, hit enter. Until mozilla fixes the problem you will need to redo this once every 24 hours: // Re-enable *all* extensions async function set_addons_as_signed() { Components.utils.import("resource://gre/modules/addon…

I wonder how long until the "security vultures" come upon this workaround and stop it from working... would be ironic if that happened sooner than the expired cert getting fixed.

Re: All extensions disabled due to expiration of intermediate signing cert

#259

Post by mrep »

hnaccy wrote: post #251
mrep wrote: post #225

Earlier quoted context omitted.

> Also, wow, the web has a ton of ads. I've been running uBlock origin so long I forgot how bad it had gotten :( Try turning it off. I got rid of ublock after arstechnica complained about a lot of their users blocking ads years ago and it honestly isn't that bad. Every once in a while I do back out of a page for maxing out one of my cpu cores but otherwise, nothing ever bad happens. With ads: either it takes me half…

>nothing ever bad happens. With ads: either it takes me half a second to tell I'm not interested in an ad, or I actually am interested and i follow the ad because I am interested and I want to support the website. You just described something bad.

Assuming you mean that half second looking at the ad: Name a better alternative for funding the internet. Paywalls at every website?

Re: All extensions disabled due to expiration of intermediate signing cert

#260

Post by rndgermandude »

electrotype wrote: post #40

Newbie question: why can't they just renew the certificate, like in 5 minutes?

A new certificate can be generated if you have to in a couple of minutes, sure. Of course, you probably defined some procedures to do it properly and securely that require more time.

Then the issue becomes: how to get the new certificate to a few hundreds million users?

If it was a certificate on some server, just replace it there, done. Client software will just pick it up. But not here. A copy of the certificate is shipped in every add-on package file. Oops. Now you have to re-sign all add-ons with the new certificate. And get those resigned files to the users.

Essentially it works like this (which is a slightly modified jar/apk signing mechanism):

- An add-on package is a zip file and other than the actual files there is also a list of known-good hashes of those files in a file called "manifest.mf" in the META-INF folder

- Then there is a file "META-INF/mozilla.sf" giving hashes of "manifest.sf"

- And finally, there is "META-INF/mozilla.rsa", which is a DER-encoded pkcs7 signature and two certificates. The signature verifies "mozilla.sf" was not tampered with and still is the same as when it was signed by mozilla. Which in turn verifies the known-good hashes are still proper.

- The signature is made with a generated certificate, the first one included in "mozilla.rsa". E.g. "CN=uBlock0@raymondhill.net" in case of uBlock.

- The "CN=uBlock0@raymondhill.net" certificate was issued by an intermediate certificate "CN=signingca1.addons.mozilla.org". This "CN=signingca1.addons.mozilla.org" is the second certificate in mozilla.rsa. It says "Validity Not After : May 4 00:09:46 2019 GMT". Oops. This is where the chain breaks now!

- "CN:signingca1.addons.mozilla.org" was issued by "CN=root-ca-production-amo". This root certificate is baked straight into the browser and not part of mozilla.rsa.

Therefore, it is not enough to issue another intermediate certificate (e.g. "CN=signingca-number-two.addons.mozilla.org"), but you have to actually generate a new "CN=uBlock0@raymondhill.net" (or whatever) signed by this new certificate, put those two certificates and a new signature of "mozilla.sf" based on those new certificates into a new mozilla.rsa FOR EACH add-on and ship updated add-on files.

PS:

Try it yourself... Extract some addon package (it's a zip file). Then:

    openssl pkcs7 -in META-INF/mozilla.rsa -inform DER -print
Post reply on HN