All extensions disabled due to expiration of intermediate signing cert • Hacker News Board

Re: All extensions disabled due to expiration of intermediate signing cert

#761

Post by johnnycab » Sat, May 04, 2019, 3:56 PM UTC

XORcat wrote: post #592

DoctorOetker wrote: post #548

Earlier quoted context omitted.

I read at https://discourse.mozilla.org/t/certificate-issue-causing-ad... >12:50 p.m. UTC / 03:50 a.m. PDT: We rolled-out a fix for release, beta and nightly users. The fix will be automatically applied in the background within the next few hours, you don’t need to take active steps. >In order to be able to provide this fix on short notice, we are using the Studies system. You can check if you have studies enabled by…

JSON response from the `normandy` API here: https://xor.cat/assets/other/random/2019-05-04/normandy_sign... hotfix-update-xpi-signing-intermediate-bug-1548973: https://storage.googleapis.com/moz-fx-normandy-prod-addons/e... From the looks, it installs the above plugin, and changes `app.update.lastUpdateTime.xpi-signature-verification` to `1556945257` I can't get it to work in ESR 60 though. Getting file not found on…

>hotfix-update-xpi-signing-intermediate-bug-1548973: https://storage.googleapis.com/moz-fx-normandy-prod-addons/e...

This fixed it for me. Thanks. W10/FF 66.0.3

Re: All extensions disabled due to expiration of intermediate signing cert

#762

Post by snazz » Sat, May 04, 2019, 3:56 PM UTC

bostik wrote: post #345

floatingatoll wrote: post #283

Earlier quoted context omitted.

Seems unlikely. If you’re willing and able to run code like the above, sourced from a random comment on the Internet, there’s no amount of security vulture that’s going to protect you from skillfully making your Internet experience unsafe for yourself.

Isn't that how most programming, security or not, works these days anyway? Joe Random Developer googles for a problem, hits SO, tries a couple of the different proposed snippets and keeps the one that happens to work. (For given values of "work".) This would be a great spot to end the post with a " ", but sadly that'd be lying. Up until ~2 years ago the most common solution to requests between different subdomains su…

You can even automate the procedure: https://gkoberger.github.io/stacksort/

Re: All extensions disabled due to expiration of intermediate signing cert

#763

Post by DoctorOetker » Sat, May 04, 2019, 3:57 PM UTC

XORcat wrote: post #592

DoctorOetker wrote: post #548

Earlier quoted context omitted.

I read at https://discourse.mozilla.org/t/certificate-issue-causing-ad... >12:50 p.m. UTC / 03:50 a.m. PDT: We rolled-out a fix for release, beta and nightly users. The fix will be automatically applied in the background within the next few hours, you don’t need to take active steps. >In order to be able to provide this fix on short notice, we are using the Studies system. You can check if you have studies enabled by…

JSON response from the `normandy` API here: https://xor.cat/assets/other/random/2019-05-04/normandy_sign... hotfix-update-xpi-signing-intermediate-bug-1548973: https://storage.googleapis.com/moz-fx-normandy-prod-addons/e... From the looks, it installs the above plugin, and changes `app.update.lastUpdateTime.xpi-signature-verification` to `1556945257` I can't get it to work in ESR 60 though. Getting file not found on…

Thanks for the sleuthing, but who does this repository belong to? I'd like to apply it but only if mozilla provides such instruction on their issue page, I don't know who the actual owner of /moz-fx-normandy-prod-addons/ is...

https://storage.googleapis.com/moz-fx-normandy-prod-addons/e...

Can mozilla please verify, confirm authenticity, and list this instruction on their issue page?

Re: All extensions disabled due to expiration of intermediate signing cert

#764

Post by gator-io » Sat, May 04, 2019, 3:57 PM UTC

mikeash wrote: post #758

Certificates have been in common use online for maybe two decades now, if not more. This is a common failure mode and it keeps happening. Is there some fix so we don’t have to keep dealing with spontaneous failures due to expirations? Or are we doomed to suffer with this until the end of time?

Use a certificate monitor https://letsmonitor.org (free)

Re: All extensions disabled due to expiration of intermediate signing cert

#765

Post by robolange » Sat, May 04, 2019, 3:58 PM UTC

lvh wrote: post #753

neiman wrote: post #749

Earlier quoted context omitted.

Unless the entity that pushes the updates become malicious, then they're a security hole.

How do you audit Firefox updates? Because if the answer is “I don’t”, Mozilla already controls the most important piece of userspace code on your computer. And if the answer is “I don’t install them”, then everyone with a few grand to spare already controls the most important piece of userspace code on your computer.

I rely on the Debian system to assist with that. Normandy bypasses that system, if it's enabled. (The jury is out whether it's actually enabled in Debian Firefox ESR.)

Re: All extensions disabled due to expiration of intermediate signing cert

#766

Post by acqq » Sat, May 04, 2019, 3:59 PM UTC

gpm wrote: post #735

acqq wrote: post #674

Earlier quoted context omitted.

If you're still not being hit, and if the browser console doesn't accept the input, is it enough to get from the WebConsole Math.floor( (new Date()).getTime()/1000 ) and paste the number in "app.update.lastUpdateTime.xpi-signature-verification" to be off the hook for the next 24 hours?

Uh... if that outputs a unix date yes (I think) except you need to restart the browser afterwards as well.

> if that outputs a unix date yes

Yes, the JavaScript's getTime() is in milliseconds since Jan 1 1970 and the C time_t (which is what I think is used as a timestamp) is in seconds.

Re: All extensions disabled due to expiration of intermediate signing cert

#767

Post by DoctorOetker » Sat, May 04, 2019, 4:00 PM UTC

Certhas wrote: post #726

betterunix2 wrote: post #677

Earlier quoted context omitted.

At some point in the next five-ten years we will see this "feature" abused. Maybe Mozilla will use it to "soften" commonly used ad blockers to enable "acceptable" ads for Firefox users. Maybe Mozilla will be hacked by some government that wants to enable MITM attacks against its citizens, and Normandy will make that happen. Or maybe Mozilla will just cooperate with the government trying to do so. You say it is "typic…

The level of paranoia throughout this thread is truly through the roof..... Mozilla has had several "PR nightmare" decisions that a vocal set of users didn't like, and sometimes were genuinely ill advised/bad/shitty. But as far as I can see they do not have a bad track record when it comes to security/privacy. Do you have any examples of actual serious security/privacy fuck ups by Mozilla/Firefox? I mean that stood u…

> Do you have any examples of actual serious security/privacy fuck ups by Mozilla/Firefox?

Sadly I don't, but others argue they have top notch standard security practices like automated alerts etc. regarding certificate renewals...

Re: All extensions disabled due to expiration of intermediate signing cert

#768

Post by 0xdeadb00f » Sat, May 04, 2019, 4:05 PM UTC

Chirael wrote: post #143

Just discovered the same message in the Tor browser, and it seems that NoScript got disabled. So people running Tor are a lot more vulnerable right now. Also, wow, the web has a ton of ads. I've been running uBlock origin so long I forgot how bad it had gotten :(

That really sucks that Tor was vulnerable to this too.

Tor needs to fork Firefox "properly" and remove all of Mozilla's bullshit like I've seen some forks do (Waterfox?). I thought this would be common sense for the people at Tor.

Re: All extensions disabled due to expiration of intermediate signing cert

#769

Post by reubenmorais » Sat, May 04, 2019, 4:08 PM UTC

bilbo0s wrote: post #638

SilasX wrote: post #623

Earlier quoted context omitted.

Why is it supposed to be reassuring that their “studies” can override the cryptographic infrastructure? Edit: rephrase for clarity

Thank you. I happen to be one of the users with Normandy disabled, so I'm foobar'd anyway. That said, the reason I disabled it is because it is a security hole you could drive a semi-truck through. And now they want us to enable it to provide a "fix" for the secure way in? I thought I was the only one who saw a problem with that. Your post is evidence that I'm not completely off in my thinking.

The studies system is also code-signed, but with a different certificate chain, hence why it wasn't affected. What security hole do you think this opens in Firefox?

Re: All extensions disabled due to expiration of intermediate signing cert

#770

Post by AsyncAwait » Sat, May 04, 2019, 4:13 PM UTC

brynjolf wrote: post #579

AsyncAwait wrote: post #577

Earlier quoted context omitted.

> There's no obvious way to disable the Normandy back door. ??? It's a publicly documented feature with a publicly documented way to disable it.

With an obscure name and no correlation to all the other spying and backdoor ING Mozilla are doing. Is this really the best option tog etaprivacy focused browser? I think this is all very worrying.

I am not sure what 'spying' Mozilla is doing, but I agree this should be better named and better highlighted.