search

palant / pfp

A simple and secure browser extension to be used with KeePass databases.
https://pfp.works/
Mozilla Public License 2.0
113 stars 14 forks source link

not work when dom.workers.enabled=false #75

Closed ad1862 closed 6 years ago

ad1862 commented 6 years ago

In my FF workers are disabled because of security concerns. Version 1 worked without problems, but version 2 now does not work. Is it possible to use this extension without enabling workers?

FF 56.0.2

ghost commented 6 years ago

It seems that pref is being removed ind next ESR: https://bugzilla.mozilla.org/show_bug.cgi?id=1434934

ad1862 commented 6 years ago

"Worker should be always enabled." another "improvement" in >=57. I hope that this pref can be avoided.

palant commented 6 years ago

In my FF workers are disabled because of security concerns.

What kind of security concerns? Webpages not blocking everything on a heavy operation shouldn't normally be a concern. That's exactly what PfP is doing - password generation is a very heavy operation, it should be running in background. The only reason we (usually) avoided workers in the previous version was that PBKDF2 is implemented by the browser and the browser took care of running this operation in background.

Definitely "wontfix" and I'd strongly advise against messing with that kind of prefs. Firefox removing this pref makes total sense.

palant commented 6 years ago

Seeing that you are still on Firefox 56, I guess I understand the concern. Frankly, disabling browser functionality won't keep you safe on an outdated browser. A browser is a highly complex beast, and you cannot pinpoint the complexity to a single component - it's rather the web platform as such being complex. Installing updates is the only way to stay safe. Well, other than using lynx that is.