News for hackers. Stuff that matters.

A comment on Password Managers. Parent comment

Re:Password Managers by mimimi31 on Sunday June 06, 2021 @03:12PM (#27415475)
I have a hard time imagining how they enforce that. What keeps a malicious program from replicating the exact changes that Firefox makes when installing an extension? What about just replacing the whole profile folder with one that has a malicious extension installed?

>Firefox has absolutely mandatory code signing for extensions

That helps I guess, but there are clearly still malicious extensions that can pass the automated tests and get signed. Even if that wasn't possible, you could probably use some userscript extension and load malicious scripts that way.

[ Parent | on HN ]
Re:Password Managers by Wowfunhappy on Sunday June 06, 2021 @08:16PM (#27417599)
> What keeps a malicious program from replicating the exact changes that Firefox makes when installing an extension? What about just replacing the whole profile folder with one that has a malicious extension installed?

I obviously haven't spent time trying to break this, but I would assume the config file is hashed. You probably could replace the whole profile, but that would be very noticeable to the user.

[ Parent | on HN ]