News for hackers. Stuff that matters.
Re:Mozilla has defeated Microsoft’s default browser protecti... by lawl on Monday September 13, 2021 @09:21AM (#28511128)
Re:Mozilla has defeated Microsoft’s default browser protecti... by Someone1234 on Monday September 13, 2021 @10:25AM (#28511901)
Looks like it is going to:

Computer\HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts

For ".html", ".htm" and:

Computer\HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations

For "https", "http" then:

- Nuke the UserChoice key because Microsoft put special permissions on it.

- Re-create the UserChoice key setting the ProgId to Firefox and then calculating the hash.

- The hash is calculated using, in part, a hard-coded Windows internal GUID see FormatUserChoiceString here:

https://hg.mozilla.org/releases/mozilla-release/diff/7e775ce...

The whole thing looks super easy for Microsoft to break in a future Windows release unfortunately.

Re:Mozilla has defeated Microsoft’s default browser protecti... by Egoist on Monday September 13, 2021 @11:23AM (#28512641)
Interestingly, the first two registry steps are actually the same as the previous windows. Having it behind a hash seems way too user hostile though.
Re:Mozilla has defeated Microsoft’s default browser protecti... by layer8 on Monday September 13, 2021 @02:15PM (#28514784)
Re:Mozilla has defeated Microsoft’s default browser protecti... by bob1029 on Monday September 13, 2021 @01:12PM (#28513969)
> The whole thing looks super easy for Microsoft to break in a future Windows release unfortunately.

There are more aggressive techniques available that cannot be turned off very easily. TrustedInstaller is the first one that comes to mind. If you cant politely ask the registry, you can always nuke edge from orbit.

I hope Firefox keeps pushing down this route. Make your installation process as inflammatory as possible. I would encourage a "Remove all existing web browsers" checkbox in the final pane of the installation process - Default selected, of course. Give them a proper taste of their own medicine.

Re:Mozilla has defeated Microsoft’s default browser protecti... by jefftk on Monday September 13, 2021 @06:17PM (#28517632)
> "Remove all existing web browsers" checkbox

Users having multiple browsers installed that they switch between is a good thing that puts more pressure on browsers to improve, and I would hate to see Firefox or any other vendor push the dynamic farther away from that.

Re:Mozilla has defeated Microsoft’s default browser protecti... by deoxykev on Monday September 13, 2021 @02:09PM (#28514715)
Looks like the hard-coded Windows internal GUID is found in C:\Windows\SysWOW64\Shell32.dll

If you search for the string: "User Choice set via Windows User Experience", you'll find the GUID used to calculate the hash.

Re:Mozilla has defeated Microsoft’s default browser protecti... by jftuga on Monday September 13, 2021 @10:08AM (#28511693)
An interesting excerpt:

    // When Windows creates this key, it is read-only (Deny Set Value), so we need
    // to delete it first.
    // We don't set any similar special permissions.
Re:Mozilla has defeated Microsoft’s default browser protecti... by arsome on Monday September 13, 2021 @10:37AM (#28512056)
The fun bit (the generation of the "UserChoice" hash) is here:

https://searchfox.org/mozilla-central/source/browser/compone...

Re:Mozilla has defeated Microsoft’s default browser protecti... by vxNsr on Monday September 13, 2021 @10:07AM (#28511681)
This is what I was looking for.