Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

proxy CWS signatures through our server for Brave extensions or all extensions #1704

Closed
diracdeltas opened this issue Oct 18, 2018 · 2 comments
Closed

proxy CWS signatures through our server for Brave extensions or all extensions #1704

diracdeltas opened this issue Oct 18, 2018 · 2 comments
Labels
priority/P3 The next thing for us to work on. It'll ride the trains. privacy/connect This requires making a network connection to a third-party service. security
Milestone
Closed / Dupe / I...

Comments

@diracdeltas
Copy link
Member

diracdeltas commented Oct 18, 2018 •
edited
Loading

(follow-up from brave/brave-core#674 (review))

For the one extension which is installed from the go-updater for now (PDFJS), we disable CWS signature checking. Eventually there should be some way that these extensions also get the security benefits of CWS signature verification/

Based on https://cs.chromium.org/chromium/src/chrome/browser/extensions/install_verifier.h?q=install_verifier.h&sq=package:chromium&g=0&l=30-35, it seems maybe easier to use the proxy to verify the entire set of installed extensions vs just the subset which are not CWS-managed.
@diracdeltas diracdeltas added security priority/P3 The next thing for us to work on. It'll ride the trains. labels Oct 18, 2018
@diracdeltas diracdeltas changed the title proxy CWS signatures through our server for Brave extensions proxy CWS signatures through our server for Brave extensions or all extensions Oct 18, 2018
@bbondy bbondy added this to the 1.x Backlog milestone Oct 19, 2018
@tildelowengrimm tildelowengrimm added the privacy/connect This requires making a network connection to a third-party service. label Oct 19, 2018
@rebron rebron modified the milestone: 1.x Backlog Feb 7, 2019
@diracdeltas
Copy link
Member Author

we are deprecating PDFJS so this is no longer an issue for it

@bsclifton
Copy link
Member

@jumde would this be needed to implement the EnforceStrict check?

@bbondy bbondy added this to the Closed / Invalid milestone Jun 3, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
priority/P3 The next thing for us to work on. It'll ride the trains. privacy/connect This requires making a network connection to a third-party service. security
Projects
None yet
Milestone
Closed / Dupe / Invalid
Development

No branches or pull requests
5 participants
@diracdeltas @tildelowengrimm @bbondy @bsclifton @rebron