Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

All extensions disabled due to expiration of intermediate signing cert

bugzilla.mozilla.org

Post reply on HN
Print view View original

151–160 of 955 posts

Re: All extensions disabled due to expiration of intermediate signing cert

#151

Post by lugg »

SomeHacker44 wrote: post #85
kam wrote: post #25

Earlier quoted context omitted.

ACME / Let's Encrypt go in the direction of making expiry happen so often that renewal gets automated, rather than a being a rare manual process that can be forgotten about. Not sure that's viable for a signing certificate like this, but that's the way to solve it for the web PKI.

This is just abusive to the vast majority of users who do not care but still want to use SSL for their servers, frankly. I should be allowed to choose a near unlimited lifetime for my server's certificate if I don't care about the risks that may present.

Security tends towards the lowest common denominator. I'd rather you just figured out how to run a cron job.

The problem comes if your keys ever get compromised or cracked all your historical traffic becomes vulnerable instead of just the most recent window.

Re: All extensions disabled due to expiration of intermediate signing cert

#152

Post by otakucode »

needle0 wrote: post #12

I’ll still keep using Firefox since I recognize the importance of browser diversity and the hazards of a Chrome monoculture (that and vertical tabs), but, yikes. Still, this type of oversight seems all too common even in large companies. I remember several cases from Fortune 500 companies in the past few years alone. What would be a good way to automate checking for them? Has anyone developed a tool designed specific…

>Has anyone developed a tool designed specifically to avoid certificate expiry disasters?

Is anything more than a calendar reminder on the phone of someone important enough to shake the Earth and get it fixed For. Certain. needed? Like, say, the CEO, CTO, and CFO should at a minimum get a notification so they can ask if the refresh was done when necessary?

Re: All extensions disabled due to expiration of intermediate signing cert

#153

Post by jacob019 »

weavejester wrote: post #48

There's a workaround that involves going to about:config and setting xpinstall.signatures.required to false. However, if you're running the Stable or Beta version, it will only work under Linux. On Windows and MacOS you'll need to download Nightly or the Developer Edition. To fix this on MacOS I did the following: 1. Downloaded and installed Firefox Nightly 2. Ran /Applications/Firefox\ Nightly.app/Contents/MacOS/fir…

Works on android too.

Re: All extensions disabled due to expiration of intermediate signing cert

#154

Post by Chirael »

dvdgsng wrote: post #129

Is Tor Browser also affected?

Looks like it. I had the same yellow "One or more installed add-ons cannot be verified and have been disabled" banner in the Tor browser as in Firefox, the NoScript extension icon is missing, and I went to two different "do I have Javascript enabled" sites and they both said JS is enabled.

Re: All extensions disabled due to expiration of intermediate signing cert

#155

Post by Godel_unicode »

httpsterio wrote: post #93
SomeHacker44 wrote: post #85

Earlier quoted context omitted.

This is just abusive to the vast majority of users who do not care but still want to use SSL for their servers, frankly. I should be allowed to choose a near unlimited lifetime for my server's certificate if I don't care about the risks that may present.

As the service provider, you shouldn't get to decide. I think it's the users who can decide how long lived certs they're willing to trust.

That's cool and all, but what percentage of users do you think even know certs expire? I'd put the over/under at 1%.

Re: All extensions disabled due to expiration of intermediate signing cert

#156

Post by adtac »

wbl wrote: post #15
needle0 wrote: post #12

I’ll still keep using Firefox since I recognize the importance of browser diversity and the hazards of a Chrome monoculture (that and vertical tabs), but, yikes. Still, this type of oversight seems all too common even in large companies. I remember several cases from Fortune 500 companies in the past few years alone. What would be a good way to automate checking for them? Has anyone developed a tool designed specific…

We scan our codebase for anything that looks like a cert and send emails when it gets close. Might not have helped here if it was an intermediate owned by a CA. There but for the grace of God go I.

Why do you have certificates in your code to begin with?

Re: All extensions disabled due to expiration of intermediate signing cert

#157

Post by Godel_unicode »

tty2300 wrote: post #108
dev_dull wrote: post #98

Earlier quoted context omitted.

It’s funny to me that people talk about this limitation as if it were some kind of virtue.

Its also more secure. Long lived certs risk the possibility that someone who used to own the domain got a certificate on it and it still works after the domain is resold. Once you automate it there is no downside to short lived certs.

If only there were a way to revoke certificates. Like, some kind of list.

Re: All extensions disabled due to expiration of intermediate signing cert

#158

Post by jtl999 »

phyzome wrote: post #107
jtl999 wrote: post #97

Running Firefox 66 from Ubuntu repositories on Ubuntu 18.04 and all my extensions are enabled. Does it only occur after a restart or?

I believe it happens the next time Firefox goes to check for addon updates. You may want to proactively set xpinstall.signatures.required=false which... I think might work for 66 on Linux? It worked for 60.

Ah, checking `app.update.lastUpdateTime.xpi-signature-verification` shows that it hasn't checked since "yesterday"

:/

  jtl@laptop-linux:~$ TZ=UTC date --date="@1556919381"
  Fri May  3 21:36:21 UTC 2019

Re: All extensions disabled due to expiration of intermediate signing cert

#159

Post by simcop2387 »

userbinator wrote: post #54
ehsankia wrote: post #43

Earlier quoted context omitted.

> Why can't I tell my copy of Firefox to ignore the certificate? Why can't I sign my own extensions? The issue is that if you leave any sort of lever that reduces security, it will be abused by bad actors. This is why browsers are having ever decreasing ways to bypass security and have full access. It is annoying, but at the end of the day, protecting 99.999% of the users trumps what us power users want.

protecting 99.999% of the users It is horribly paternalistic to advocate for keeping users ignorant, unlearning, and --- dare I say it --- easily manipulated. I will refrain from mentioning again that infamous Franklin quote. I am frankly very fucking pissed off by this authoritarian walled-garden trend, and vehemently oppose anyone who helps this industry put the nooses around the necks of others as well as their ow…

The issue here is that this wasn't done in a vacuum. Other software vendors were secretly and deceptively installing extensions that were tracking everything users were doing online.
Post reply on HN