search

danwent / Perspectives

Perspectives Firefox Extension
http://perspectives-project.org
66 stars 19 forks source link

Stop using MD5 #139

Closed d7415 closed 10 years ago

d7415 commented 10 years ago

Perspectives is showing an error in its tooltip: Perspectives: an internal security change error occurred: TypeError: ti.cert.md5Fingerprint is undefined.

Mozilla seem to have given up on MD5, so Perspectives really has to. At a glance, it seems the server can be changed by simply replacing all occurrences of "md5" with e.g. "sha256". My preliminary tests shows that it runs and generates the hashes like this.

The extension seems like more work to me (but I'm happier in Python), but I can take a look when I get time if no-one beats me to it.

Until then, the extension seems largely useless.

myano commented 10 years ago

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512

On 08/28/2014 11:09 AM, d7415 wrote:

Perspectives is showing an error in its tooltip: Perspectives: an internal security change error occurred: TypeError: ti.cert.md5Fingerprint is undefined.

Mozilla seem to have given up on MD5, so Perspectives really has to. At a glance, it seems the server can be changed by simply replacing all occurrences of "md5" with e.g. "sha256". My preliminary tests shows that it runs and generates the hashes like this.

The extension seems like more work to me (but I'm happier in Python), but I can take a look when I get time if no-one beats me to it.

Until then, the extension seems largely useless.

  • From my experience with the latest Firefox stable (31.0) it seems it currently works just fine. Though it seems that in the newer versions of Firefox, the beta, the nigtly, etc, that it doesn't work there. I'd assume the developers have time until 32.0 becomes the new stable?

-----BEGIN PGP SIGNATURE----- Version: GnuPG v1

iQIcBAEBCgAGBQJT/0bEAAoJEKBpQL3CDq4dpb8P/1wVrVfmdHogaQB2af6nLFvw ta69ToObuupXWZGf4UVt9Xl4tW1yQWI4lv7hr4Aiti364EpXeoOoQbo2pUSFVO03 jVx3T4kTUhllrP8QGGeQYetMpOqyhg6XbXv/Inoj+4aVMmqFJiAv/hFJLmdQdORI yOgklk9+DRtmRbMp08iP8yAl4tl32dENHN5DQJLBgIVZrzC23S7C6N8UBOn3vBzX 8ua4DORCTLXbY+LmY/W+aaMVgYDKPwyo446At+1BTzueA/gZ0QOTRluazidRiZ+X Q/Ns/nb/PGMVhMoCZ6zgXHeLlwx9TIXvrQi7NwnVd9aNC/FqmrFQY87UBtXfHIrx szGPYwvKiYmjIZkvv65RdFeqZmAyDesRu6C0U5L8Yb0W4+d5kopX1tY8BHukO6zQ LBKntMLU4GTh3jZaBQqvjhqwTl3CGOw31pCVNrjjZpQQxAUfw2dPSu1m7KsWBlR0 KV2AXUozncB5tVV0d4dZeDwOmhiAuItuFFulA7Vqi8foiHHwAc3DXizWRxhjsi8R NrfABEbSHoHz4mX/B9Et/igUW4DpP+CLhsbcEkjifhy0zTwGR+vZM0MbyrW8W4L0 FSoiDuD2pjSyEy6uqeqkmZqGSMP0EfNZZY9ACXxeHR7OVkl30CYz+WSfxL/iLdc+ Jpcho9pF4FrwKtjWDW3y =wMiI -----END PGP SIGNATURE-----

ghost commented 10 years ago

duplicate of #123

daveschaefer commented 10 years ago

Hey @d7415 thanks for the note. Yes, this is happening because Firefox is stopping support for MD5. The issue isn't just that we need to fix the client code - the notaries must be updated as well to calculate other hash information and send it when requested.

We are actively working on this. We already have a ticket at #123 though, so I will close this as a duplicate.

Thanks for the report!

daveschaefer commented 10 years ago

Hey @d7415 a fix for Perspectives has now been released. It's working its way through the Mozilla review process - you can download the update directly at this link - https://addons.mozilla.org/firefox/downloads/file/277984/perspectives-4.5.2-fx+sm.xpi

Thanks for the bug report!