Modify whitelist in Chrome Extension

[eftaxiopoulos]

I want to create my own chrome extension based on yours. But I need to modify the whitelist on it so that my site can comunicate with the trezor device. But when modifying the whitelist in manifest.json nothing happens.

After searching a bit I found that there is a config_signed.bin file that is generated in trezor-common. I tried to modify the config.json file in the signer and sign it with my own private key. What I do not know is where exactly I have to import my modified config_signed.bin and also where should I put my public key in the extension code so that the config_signed.bin it can be decrypted.

I would also apreciate if you could tell me any other (easier or not) way that can allow me to achieve my goal.

p.s. I cannot use trezor connect because it does not provide enough functionalities for my website.

[prusnak]

You should work with us on improving Connect until it cointains the functionality you need. There is no other way.

[eftaxiopoulos]

I do not see how there is no other way. Since all the code of Trezor is opensource, I should be able to modiify the code in some parts and recompile with my own whitelist. I could recompile the extension, the trezor-link and whatever else needed and have my own copy of the software that accepts my own whitelist. I do not need to use your own extension. I can recompile and create my own extension to achieve what I need.

[karelbilek]

First, VERY IMPORTANT thing - Trezor Extension is actually "Chrome App", not "Chrome Extension", and Chrome Apps will be dead soon. Only Chrome Apps can talk with HID devices. I am not sure if it's now possible to add new Chrome Apps to the store. We are now changing our firmware to use WebUSB and we will kill this extension.

So you should probably not start a new extension that talks to Trezor, since that route is being killed.

---

config_signed.bin has two different purposes.

First, there is a list of allowed domains - however, see below. Second, there is definition of protobuf. And it is all signed with our key, and this is checked in the extension (on the lower layer, in trezor-link npm package)

The checking of the signature is done here, together with setting the protobuf

https://github.com/trezor/trezor-link/blob/master/src/lowlevel/verify.js#L41

The domain list in the config_signed is not used in the extension, since we cannot dynamically changed allowed URLs.

The allowed list in in the manifest. The manifest is here - https://github.com/trezor/trezor-chrome-extension/blob/master/manifest_no_matches.json - but see that externally_connectable - which URLs are allowed - is not defined there. That is changed on build by this script - https://github.com/trezor/trezor-chrome-extension/blob/master/build_manifest.py

If you want your own extension, just take the manifest and change externally_conectable and add your URL.

[prusnak]

@eftaxiopoulos I meant "there is no other officially supported way if you want to give the functionality to all users". If you want to integrate TREZOR into your website and give the functionality to users, Connect is the way to go. OTOH If you want to build your own stack, including web stuff and even firmware, you are free to do so, of course.

Answer to the question you asked: https://github.com/trezor/trezor-link/blob/master/src/lowlevel/verify.js#L10-L15

[eftaxiopoulos]

@prusnak I understood now. Thank you very much!

@karel-3d Thank you for your answer. First thing that I didn't understand is why since the extension (or better the app) will stop existing, the communication cannot be performed with the tresord. In the same way that happens now for different browsers. Is there any problem with tresord, or any reason to deprecate it and use only webusb?

In case tresord can still be used, which would be the way to change the white-list on it? Would we need the config_signed?

Will your new implementation with webusb be publish on git?

[karelbilek]

@eftaxiopoulos There is no need for the extension when there is trezord and webusb.

[eftaxiopoulos]

I know that when there is trezord, there is no need for the extension. But in your response you said that you are changing your firmware. So I imagined that for some reason trezord will be deprecated too. Is this going to happen? Or can I base my implementation in the existing trezord? Willl the firmware keep supporting communication via trezord?

[karelbilek]

We are planning new Trezord with slightly changed API that will support both new firmware with webusb and the existing one.

What application are you building exactly?

[eftaxiopoulos]

We are currently building all software available on your git and we made a hardware prototype of the device based on your schematics, in order to verify that everything is open source and there are no backdoors.