Jean-Marc Desperrier wrote:I don't see this two steps in the current Mozilla. [...]
They are treated as "unsigned" since the signature didn't validate correctly.
Anyway, the real decision can only really be made *after* the download is over and the full info is available.
I agree --- but we can show the user what we think it might be, then verify what we told the user.
I didn't realize the XPI dialog I see is prompted *before* the download.
If the purpose is to protect the user from downloading insecure content, then signature can not work.
So it would be better to change that.
I disagree. MS does the same thing with there signed downloads (cabs, iirc)
In the MS case, after the download I get the dialog asking me if I trust the signed content and want to use it.
I don't get a dialog before the download.
I haven't checked if it will not even start the download if the signature is obviously invalid, but doing this is so easily defeated by an attacker that the interest is limited.
The current XPI mechanism is :
- a major restriction on what the jar format allows (but simpler may be better). It has only one signer, and the trust is only the whole archive level.
- imposes some unnecessary incompatible restrictions by saying the rsa file must be first.
In the standard format, there will only be one .mf and one .sf file before the .rsa file. They will be small, so I see no good reason to say they must be after the rsa file.
If an attacker wants to force me to download something large, he only has to put a very large .rsa file. If I want to be able to include a crl inside an .rsa file, I'll be interested in downloading even rather large .rsa file.
Can I enter a bug for this ? (I don't think it exist already) I will *try* to fix if I can find the time. If you can just gives me the right pointeur to the source.
CC' me.
If I understand correctly, it currently works as such : - one dialog before download asking if I want the download to start - one dialog showing the progress of download and unsigned XPI will install as soon as the download is over. But what about temptatively signed XPI ? Do we have a special third dialog for them ?
I think the two current dialog should be unified into one, and the download started directly, leaving the user the choice of cancelling it.
Then at the end of the download, it will be possible to display the result of the signature verification in the same unified dialog.
_______________________________________________
mozilla-crypto mailing list
[EMAIL PROTECTED]
http://mail.mozilla.org/listinfo/mozilla-crypto
