All extensions disabled due to expiration of intermediate signing cert • Hacker News Board

Re: All extensions disabled due to expiration of intermediate signing cert

#771

Post by sfink » Sat, May 04, 2019, 4:14 PM UTC

mrob wrote: post #122

macintux wrote: post #63

Earlier quoted context omitted.

I’ve been in software development and operations for 25 years. I still don’t want to have to understand everything I ever touch, even if I could.

>I still don’t want to have to understand everything I ever touch If you don't understand it, don't touch it. The default settings should work for most users. There can even be a warning against touching without understanding, like with Firefox's about:config. The offensive thing is preventing users from touching even if they do understand.

The difficulty is in how to keep them available to end users while keeping them unavailable to malware and bad actors who post "helpful" advice or publish temporarily useful addons that get updated to malware.

I'm not disagreeing with you, but the right mechanism is not straightforward to figure out, and you'll always be in a game of cat and mouse. One that sucks resources from whatever other useful stuff you might be spending your (or Mozilla's) time on.

Re: All extensions disabled due to expiration of intermediate signing cert

#772

Post by Piskvorrr » Sat, May 04, 2019, 4:17 PM UTC

hyeonwho4 wrote: post #605

vesinisa wrote: post #598

Earlier quoted context omitted.

I sure wonder how people so suspicious of Mozilla dare use their browser .

Setting preferences really should not be shocking, given that they have the capacity to run automatic updates. I'm more surprised that they can push code without certificates.

The expires certificate seems to be in a chain concerning extensions. Not necessarily the same chain concerning core browser updates...

Re: All extensions disabled due to expiration of intermediate signing cert

#773

Post by overgard » Sat, May 04, 2019, 4:21 PM UTC

Well, a little bit of empathy for mozilla here: I've seen a lot of IT departments that don't have any sort of great system in place for managing certs. A lot of places I worked, I always had a suspicion they were a ticking time bomb. It's not enough work that it's really anyone's full time job to manage them. Also, at larger companies, you might have divisions that do it in different ways without cohesion. And then a lot of times certificate expiration is so far in the future that the people that initially setup a certificate might have left the company and forgot to document it, etc. So that kind of thing can easily fall through the cracks.

Maybe a constructive thing I'm curious about: What is considered best practice for managing certs? How do people do this in a secure way that makes sure they get renewed in a timely way?

Re: All extensions disabled due to expiration of intermediate signing cert

#774

Post by [deleted] » Sat, May 04, 2019, 4:22 PM UTC

[deleted]

Re: All extensions disabled due to expiration of intermediate signing cert

#775

Post by semperfi » Sat, May 04, 2019, 4:23 PM UTC

I did my part by sending angry emails to every @mozilla.org address and making duplicate bug reports on https://bugzilla.mozilla.org with multiple IPs.

This bug won't be fixed until "Wednesday at the earliest," so you have a lot of time.

Re: All extensions disabled due to expiration of intermediate signing cert

#776

Post by sfink » Sat, May 04, 2019, 4:23 PM UTC

lvh wrote: post #134

333c wrote: post #57

Can someone explain exactly what went wrong? I don't think I quite understand, but 7/9 of my extensions have been disabled.

Firefox requires extensions installed via their "store" be signed with a certificate to make sure they're actually from there. That certificate has an expiry date. It expired, so now all of its signatures are invalid -- and Firefox no longer trusts the associated extensions.

A minor added detail is that it wasn't the leaf certificate that expired. I've heard that that would have been handled properly. It was an intermediate cert, and I guess that possibly wasn't fully taken into account? (This is 3rd hand knowledge and speculation, note.)

Re: All extensions disabled due to expiration of intermediate signing cert

#777

Post by sfink » Sat, May 04, 2019, 4:27 PM UTC

verisimilitudes wrote: post #224

This relates to my opinions about encrypted HTTP, which is that it shouldn't be mandatory. If you have a well-designed system that only works with encryption, then sure, but this idea of using the same mistaken systems as the WWW clearly doesn't work well. I've never seen a Tor Hidden Service fail because of something expiring. Much of this nonsense about encrypting everything, without reason and excuse, is to protec…

Requiring https is a different situation and much more defensible in my mind. It's way too easy to rewrite the web pages of everyone using library or coffeeshop wifi and thereby hack/phish a lot of people's browsers.

Re: All extensions disabled due to expiration of intermediate signing cert

#778

Post by lvh » Sat, May 04, 2019, 4:27 PM UTC

robolange wrote: post #765

lvh wrote: post #753

Earlier quoted context omitted.

How do you audit Firefox updates? Because if the answer is “I don’t”, Mozilla already controls the most important piece of userspace code on your computer. And if the answer is “I don’t install them”, then everyone with a few grand to spare already controls the most important piece of userspace code on your computer.

I rely on the Debian system to assist with that. Normandy bypasses that system, if it's enabled. (The jury is out whether it's actually enabled in Debian Firefox ESR.)

What do you think the median size of a Firefox release is, what do you think the resources (let’s call it US dollars FMV) are to audit that, and what do you think the resources Debian has to devote to it?

Clearly more eyes are good, but... In between “Wild West WebExtensions” and “Mozilla backdoors my Firefox and it gets used for nefarious purposes” and “delays in browser updates increase exploitation windows”, I know which threat models I’m buying.

Re: All extensions disabled due to expiration of intermediate signing cert

#779

Post by lvh » Sat, May 04, 2019, 4:31 PM UTC

tialaramex wrote: post #417

lvh wrote: post #199

Earlier quoted context omitted.

Certificate Transparency works pretty darn well for most usecases, we (Latacora) have found while trying to solve exactly this problem (or at least the figure out which certs exist that aren't being regularly re-issued part) :-)

Caveats: Certificates that aren't from the Web PKI almost invariably won't be logged. Most logs explicitly refuse everything except certs from the Web PKI so as not to be burdened storing garbage. So this won't find certs issued by the custom OpenSSL CA on that one guys Linux laptop. Not all Web PKI certs are logged. There is no BR obligation and no root store programme rule that requires logging. The only things in…

You can tell ACM your CT preference!

(But seriously, sure you’re right but for my audience (which is essentially Latacora’s and HN’s), CT is fine.)

Re: All extensions disabled due to expiration of intermediate signing cert

#780

Post by lvh » Sat, May 04, 2019, 4:32 PM UTC

sfink wrote: post #776

lvh wrote: post #134

Earlier quoted context omitted.

Firefox requires extensions installed via their "store" be signed with a certificate to make sure they're actually from there. That certificate has an expiry date. It expired, so now all of its signatures are invalid -- and Firefox no longer trusts the associated extensions.

A minor added detail is that it wasn't the leaf certificate that expired. I've heard that that would have been handled properly. It was an intermediate cert, and I guess that possibly wasn't fully taken into account? (This is 3rd hand knowledge and speculation, note.)

That is accurate :)