Tor Browser and Mozilla addon verification
Hi, does Tor Browser check addon code for tampering for addons downloaded from the Mozilla server?
On 2017-02-18 03:44, bancfc@openmailbox.org wrote:
Hi, does Tor Browser check addon code for tampering for addons downloaded from the Mozilla server?
Our usecase is running the foxyproxy addon to be able to use TBB with I2P. On 7.0a1 it (the Debian packaged foxyproxy version) works when you disable xpinstall.signatures.required. However this workaround doesn't work with the latest addon-manager version from Mozilla. It prompts for a browser restart but after it's still not enabled after doing it.
bancfc@openmailbox.org:
On 2017-02-18 03:44, bancfc@openmailbox.org wrote:
Hi, does Tor Browser check addon code for tampering for addons downloaded from the Mozilla server?
Our usecase is running the foxyproxy addon to be able to use TBB with I2P.
On 7.0a1 it (the Debian packaged foxyproxy version) works when you disable xpinstall.signatures.required.
However this workaround doesn't work with the latest addon-manager version from Mozilla. It prompts for a browser restart but after it's still not enabled after doing it.
Not sure what you mean with "latest addon-manager version from Mozilla" but it seems to me we are doing no such checks. Georg
Georg Koppen:
bancfc@openmailbox.org:
On 2017-02-18 03:44, bancfc@openmailbox.org wrote:
Hi, does Tor Browser check addon code for tampering for addons downloaded from the Mozilla server?
Our usecase is running the foxyproxy addon to be able to use TBB with I2P.
On 7.0a1 it (the Debian packaged foxyproxy version) works when you disable xpinstall.signatures.required.
However this workaround doesn't work with the latest addon-manager version from Mozilla. It prompts for a browser restart but after it's still not enabled after doing it.
Not sure what you mean with "latest addon-manager version from Mozilla" but it seems to me we are doing no such checks.
Georg
Hi Georg, thank you for your reply. I'll be rephrasing these questions. The first question is: Does Tor Browser check before add-ons are installed from addons.mozilla.org signatures before installation? Same as stock Firefox? (related to xpinstall.signatures.required) Second question: Can one use Firefox add-ons from addons.mozilla.org with Tor Browser? How? Doesn't work for use. After installation of an add-on from addons.mozilla.org, Tor Browser prompts for a browser restart but after the browser restart it's still not enabled. Cheers, Patrick
Patrick Schleizer:
Georg Koppen:
bancfc@openmailbox.org:
On 2017-02-18 03:44, bancfc@openmailbox.org wrote:
Hi, does Tor Browser check addon code for tampering for addons downloaded from the Mozilla server?
Our usecase is running the foxyproxy addon to be able to use TBB with I2P.
On 7.0a1 it (the Debian packaged foxyproxy version) works when you disable xpinstall.signatures.required.
However this workaround doesn't work with the latest addon-manager version from Mozilla. It prompts for a browser restart but after it's still not enabled after doing it.
Not sure what you mean with "latest addon-manager version from Mozilla" but it seems to me we are doing no such checks.
Georg
Hi Georg,
thank you for your reply. I'll be rephrasing these questions.
The first question is:
Does Tor Browser check before add-ons are installed from addons.mozilla.org signatures before installation? Same as stock Firefox? (related to xpinstall.signatures.required)
Yes.
Second question:
Can one use Firefox add-ons from addons.mozilla.org with Tor Browser? How? Doesn't work for use. After installation of an add-on from addons.mozilla.org, Tor Browser prompts for a browser restart but after the browser restart it's still not enabled.
I just search on about:addons in a clean, new Tor Browser 6.5 for FoxyProxy and installed FoxyProxy Standard. After restart I see the FoxyProxy icon in the toolbar and seem to be able to interact with it. Not sure what is going wrong on your side. Georg
On 2017-02-20 15:53, Georg Koppen wrote:
I just search on about:addons in a clean, new Tor Browser 6.5 for FoxyProxy and installed FoxyProxy Standard. After restart I see the FoxyProxy icon in the toolbar and seem to be able to interact with it. Not sure what is going wrong on your side.
Thanks for your reply Georg. Its worth mentioning that this quirk Patrick mentions happens with 7.0a1. I think its just a bug (since signed addon support works you pointed out).
bancfc@openmailbox.org:
On 2017-02-20 15:53, Georg Koppen wrote:
I just search on about:addons in a clean, new Tor Browser 6.5 for FoxyProxy and installed FoxyProxy Standard. After restart I see the FoxyProxy icon in the toolbar and seem to be able to interact with it. Not sure what is going wrong on your side.
Thanks for your reply Georg.
Its worth mentioning that this quirk Patrick mentions happens with 7.0a1. I think its just a bug (since signed addon support works you pointed out).
Just tested with 7.0a1 and it works for me as well. Georg
participants (3)
-
bancfc＠openmailbox.org -
Georg Koppen -
Patrick Schleizer