<story><title>Technical Details on the Recent Firefox Add-On Outage</title><url>https://hacks.mozilla.org/2019/05/technical-details-on-the-recent-firefox-add-on-outage/</url></story><parent_chain><item><author>jzl</author><text>Looks like a good read. I haven&amp;#x27;t finished reading it yet, but there&amp;#x27;s something I still don&amp;#x27;t get ...&lt;p&gt;Windows and macOS both have a signing infrastructure for apps. The rules of that infrastructure dictate only that apps must have been signed by a valid certificate at the time they were signed. That way old app downloads don&amp;#x27;t need to be periodically re-signed just to account for expiring certificates. I can download a 5-year-old version of 7zip or whatever and it runs just fine because it was signed with something valid to the timestamp in the signature. The process of distributing desktop apps would be utterly insane if this were not the case.&lt;p&gt;Not following this model for browser plugins seems unnecessarily cumbersome. Is it really worth requiring all browser plugins to be signed by a &lt;i&gt;currently&lt;/i&gt; valid certificate? Is there a document or blog post where this is argued to be more appropriate?&lt;p&gt;I get that it arguably leads to more stringent security, but I&amp;#x27;m not convinced by the delta improvement of that model over the desktop model, given the additional downsides. And the &amp;quot;let everything expire after a few years and resign it&amp;quot; process should not be used as a substitution for revocation. After all, if it were determined retroactively that a malware extension was signed does it really help everyone that it can&amp;#x27;t be loaded in a year or two, given the damage it could cause right now?</text></item></parent_chain><comment><author>johnp_</author><text>It seems Mozilla is in the process[0] of moving the signature scheme to COSE, which allows timestamping[1]. A code comment[2] says that the current package format doesn&amp;#x27;t allow it.&lt;p&gt;[0] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;bugzilla.mozilla.org&amp;#x2F;show_bug.cgi?id=1545836&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;bugzilla.mozilla.org&amp;#x2F;show_bug.cgi?id=1545836&lt;/a&gt;&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;tools.ietf.org&amp;#x2F;html&amp;#x2F;rfc8152#section-4.5&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;tools.ietf.org&amp;#x2F;html&amp;#x2F;rfc8152#section-4.5&lt;/a&gt;&lt;p&gt;[2] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;searchfox.org&amp;#x2F;mozilla-central&amp;#x2F;rev&amp;#x2F;b9da45f63cb567244933c77b2c7e827a057d3f9b&amp;#x2F;security&amp;#x2F;apps&amp;#x2F;AppSignatureVerification.cpp#644&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;searchfox.org&amp;#x2F;mozilla-central&amp;#x2F;rev&amp;#x2F;b9da45f63cb5672449...&lt;/a&gt;</text></comment>
<story><title>Technical Details on the Recent Firefox Add-On Outage</title><url>https://hacks.mozilla.org/2019/05/technical-details-on-the-recent-firefox-add-on-outage/</url></story><parent_chain><item><author>jzl</author><text>Looks like a good read. I haven&amp;#x27;t finished reading it yet, but there&amp;#x27;s something I still don&amp;#x27;t get ...&lt;p&gt;Windows and macOS both have a signing infrastructure for apps. The rules of that infrastructure dictate only that apps must have been signed by a valid certificate at the time they were signed. That way old app downloads don&amp;#x27;t need to be periodically re-signed just to account for expiring certificates. I can download a 5-year-old version of 7zip or whatever and it runs just fine because it was signed with something valid to the timestamp in the signature. The process of distributing desktop apps would be utterly insane if this were not the case.&lt;p&gt;Not following this model for browser plugins seems unnecessarily cumbersome. Is it really worth requiring all browser plugins to be signed by a &lt;i&gt;currently&lt;/i&gt; valid certificate? Is there a document or blog post where this is argued to be more appropriate?&lt;p&gt;I get that it arguably leads to more stringent security, but I&amp;#x27;m not convinced by the delta improvement of that model over the desktop model, given the additional downsides. And the &amp;quot;let everything expire after a few years and resign it&amp;quot; process should not be used as a substitution for revocation. After all, if it were determined retroactively that a malware extension was signed does it really help everyone that it can&amp;#x27;t be loaded in a year or two, given the damage it could cause right now?</text></item></parent_chain><comment><author>johncolanduoni</author><text>For the time stamp method to work, you need a trusted mechanism to attest that the timestamp is correct, otherwise the mechanism is useless (an attacker with an outdated private key can just backdate the timestamp in the executable and then sign it). Windows code signing uses a server Microsoft runs to provide this, and Mozilla would need to do the same.&lt;p&gt;I’m not saying they shouldn’t, but it is a significant piece of complexity.</text></comment>