search

moxie0 / Convergence

An agile, distributed, and secure alternative to the Certificate Authority system.
http://convergence.io
623 stars 127 forks source link

Convergence should disable itself if PSM password isn't provided. #92

Closed murias closed 12 years ago

murias commented 12 years ago

Convergence is enabled, but every https website shows the normal "Verified by: SomeCA" tooltip. This should be "Verified by Convergence", right? Additionally the Convergence icon has a "Page not secure." tooltip.

Verified on different pages. Looks like this has nothing to do with some of them also sending plain text. Also, no certificates in cache.

No error messages. Convergence icon and the verification thing are both green.

This is on Windows 7 with up to date Firefox. (Already tried disabling other addons.)

Lcstyle commented 12 years ago

Order is important:

Install Fiddler2 from http://fiddler2.com/Fiddler2/version.asp Enable Convergence Launch Fiddler. Attempt to browse to an https website with convergence enabled. Save fiddler trace file->save->all sessions-> name = cnvgnceenabled

Disable Convergence. Clear all sessions from fiddler. Attempt to browse to same https website Save fiddler trace file->save->all sessions-> name = cnvgncedisabled Close Fiddler.

Attach a link to both trace files in a reply comment.

murias commented 12 years ago

http://dl.dropbox.com/u/43594979/cnvgnceenabled.saz http://dl.dropbox.com/u/43594979/cnvgncedisabled.saz

It looks like there convergence is not running at all, but I double checked.

murias commented 12 years ago

Whoops... wrong button.

Lcstyle commented 12 years ago

It's obvious convergence isn't running. What happens when you remove convergence (remove extension), restart FF, verify its gone, go to convergence.io re-install it?

Can you show us a screenshot of Firefox->Options->Advanced->Network->Settings. Also a screenshot of your about:support page.

Thank you

murias commented 12 years ago

Removing and reinstalling was the first thing I tried. (Just tried again - no effect.) But the convergence options didn't reset, could there be a problem with them?

http://dl.dropbox.com/u/43594979/firefoxsupport.txt My connection settings are set to "No proxy"

murias commented 12 years ago

I don't know why but it looks like it is working as it should now. I shut down my pc and used Firefox Sync on my linux laptop, where I then installed and tested convergence for verification. It worked there, so I tried again on my pc. It synced and now also works. I guess I'll never be able to reproduce what happened.

murias commented 12 years ago

Oh my... That's what you get if Firefox pops up a "Please enter password" prompt without an explanation for what.

So as it turns out the problem only exists if I don't enter the Master Password when I open Firefox. Bug or feature? Annoying non the less. Thanks for trying to help anyways.

Lcstyle commented 12 years ago

your firefox is only 6.0.2, latest is 7.0.1.

Not sure why the addon isn't enabled without a master password, this could be a feature.

I'll try to reproduce.

ewanm89 commented 12 years ago

Urm, firefox feature, if master password is set, we need you to enter it before firefox will give us access to NSS to add the convergence certificate, generate the keypairs for the internal CA.... #62 is the result of not asking to unlock it before we try to do any of those things.

Lcstyle commented 12 years ago

Good Point, I assumed that you had already done this upon install, technically after it does the first time, you won't need the password anymore.

moxie0 commented 12 years ago

Seems like the bug here is that Convergence should auto-disable itself if the PSM password isn't provided for a locked PSM.

E3V3A commented 12 years ago

This also seem closely related to this issue here: https://github.com/moxie0/Convergence/issues/102

moxie0 commented 12 years ago

Fixed in bcf036aceded686c45033c933cb87f4cac47ce55