Im all for signing stuff but:
- amo wasnt affected by heartbleed
- signatures arent foolproof either
- HTTPS everywhere.. is supposed to advocate for TLS being safe ?
So the criticism seems quite misguided in this case.
Why HTTPS Everywhere isn't on addons.mozilla.org
21–30 of 61 posts
Re: Why HTTPS Everywhere isn't on addons.mozilla.org
#22Old... but interesting, I guess. From the bug report: > We don't require update.rdf files to be signed when they're served over HTTPS, since HTTPS provides the same level of verification as an updateKey, and we don't see significant benefit to the additional level of verification. I'm kind of confused by that comment - Mozilla are saying that signing the software itself is somehow the same as serving it over HTTPS? T…
I think the idea is that you don't need the extra security of signing, because if the file was served over HTTPS then you can be secure in the knowledge that it has not been modified. The reason you sign packages is to ensure that the file you want and the file you get are actually the same. If you have a secure connection to the trusted host of said file, you don't need to worry about that.
> The reason you sign packages is to ensure that the file you want and the file you get are actually the same. If you have a secure connection to the trusted host of said file, you don't need to worry about that.
HTTPS provides a secure connection, in theory, but what if AMO is itself compromised? They are just a 3rd party host for the EFF's extension, after all.
HTTPS or not, the only way to check that the code you get from AMO is the same code the EFF gave AMO, is to check it against the EFF's signature.
Re: Why HTTPS Everywhere isn't on addons.mozilla.org
#23"main reason I haven't put it in AMO yet is because AMO offers less security to users than EFF self-hosting it" Another pointless crusade. Aren't there many ways you could make it safer still? Wouldn't some of those be really dumb because they would prevent many people from accessing the add on? How many people are you making more secure? Close to no one because 98% of Firefox https everywhere users have some other a…
It's almost as if their priorities aren't the same as yours.
Re: Why HTTPS Everywhere isn't on addons.mozilla.org
#24Re: Why HTTPS Everywhere isn't on addons.mozilla.org
#25"main reason I haven't put it in AMO yet is because AMO offers less security to users than EFF self-hosting it" Another pointless crusade. Aren't there many ways you could make it safer still? Wouldn't some of those be really dumb because they would prevent many people from accessing the add on? How many people are you making more secure? Close to no one because 98% of Firefox https everywhere users have some other a…
It's almost as if their priorities aren't the same as yours.
My priorities are completly irrelevant here, I've been a happy user of https everywhere since idk since I heard of it (years? idk). My criticism is that their own stated priority is being crippled by a self-imposed and arbitrary rule.
Re: Why HTTPS Everywhere isn't on addons.mozilla.org
#26Earlier quoted context omitted.
I think the idea is that you don't need the extra security of signing, because if the file was served over HTTPS then you can be secure in the knowledge that it has not been modified. The reason you sign packages is to ensure that the file you want and the file you get are actually the same. If you have a secure connection to the trusted host of said file, you don't need to worry about that.
The difference is that signed code lets you keep the signing key offline, and therefore it can be much more secure. For a concrete example, consider the case where the server is compromised and an attacker wants to insert malware. HTTPS does nothing at all to help, here. The attacker has control over the server and can make it serve whatever it wants, and since the server still has its normal certificate and key, the…
> If the code was signed using a key that isn't kept on the server (normally a code signing key will be kept on a developer's computer, and often protected by a password so it rarely exists in memory unencrypted)
And to take this even further, you have the option of keeping the key on a machine that is completely disconnected from any network. In addition, this machine could use a Hardware Security Module to further increase the security of the signing key.
Re: Why HTTPS Everywhere isn't on addons.mozilla.org
#27> Why wasn't HTTPS Everywhere affected by Heartbleed? Because we sign updates with an offline signing key that EFF keeps on a dedicated airgapped machine. So even if SSL is totally broken, the integrity of updates is guaranteed. Yay!
WHY IN THE WORLD AREN'T YOU USING AN HSM!?!?! If you're at the point where you feel the need for a dedicated airgapped machine to hold the signing key, then you are at the point where you need an HSM.
Re: Why HTTPS Everywhere isn't on addons.mozilla.org
#28Earlier quoted context omitted.
True, I'm not surprised at all. HTTPS Everywhere-like functionality should be integrated into browsers and not a downloadable extra, tricking people into feeling fully secured.
While not "everywhere"... Force SSL only: http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security Have site preloaded in Chrome: https://hstspreload.appspot.com
Firefox also has a built-in HSTS preload list, which I believe uses the Chrome list as one of its inputs: https://blog.mozilla.org/security/2012/11/01/preloading-hsts...
Re: Why HTTPS Everywhere isn't on addons.mozilla.org
#29> AMO doesn't do any code signing for extensions, so they're only protected by HTTPS. As we saw with Heartbleed, SSL private keys can be compromised. I find it quite ironic that HTTPS Everywhere is arguing HTTPS is not safe enough to offer them a reasonable guarantee of integrity.
HTTPS is a lower bound of reasonable security, not an upper one. The argument for HTTPS _everywhere_ is that it's the smallest possible thing you can do to make yourself slightly secure.
Would you find it ironic that someone selling combination locks for gym lockers wants a better lock on their storefront?
Re: Why HTTPS Everywhere isn't on addons.mozilla.org
#30> Once public key pinning lands in Firefox (supposedly scheduled to happen this summer) Since this was from April, I wonder what has happened since then? Has Firefox added public key pinning or the other option presented?
Yes, Firefox has supported public key pinning for a while now. You can check the latest status at https://wiki.mozilla.org/SecurityEngineering/Public_Key_Pinn...
Thanks.