Browser connection refused [Waterfox not supported]

This discussion was created from comments split from: Browser connection refused.

Comments

  • kswartz
    kswartz
    Community Member
    edited June 2019

    I am now running into this scenario too.

    I am finally taking the jump from 1Password 4 to 1Password 7, for which I've set up a family membership. But my first test seems to be failing: I was able to use the old browser extension with 1Password 4 without any difficulty using the Waterfox 56.2.10 browser (a fork of Firefox ESR). But it appears the extension won't load in this browser now that I've moved to 1Password 7 (v 7.3.684), claiming it is an untrusted source.

    Some additional info: I'm testing on two different machines. On one, I uninstalled 1Password 4 and rebooted. I get the message above. 1Password says the refused connections are from explorer and 1Password.exe, which is somewhat confusing. I can't get it to work in this browser at all, though.

    On another machine, I tried regressing. I uninstalled 1Password 7, reinstalled 1Password 4. I have "verify browser signature" disabled (always did). However, the addon STILL will not work, even after rebooting. So installing 1Password 7 -- even after uninstalling -- seems to have done something to prevent the addon from working as it did before.

    Have you gotten rid of the option to disable browser signature verification, as you had in the 1Password 4 desktop app? So it can't be used in browsers built from source, or forks? Is there a way to override that in the application? Other, it will mean a pretty quick stop to my 30-day trial.

    Thanks,
    Keith

  • Hi @kswartz,

    If you wish to use these other unsupported browsers, you can use 1Password X instead if you have the 1Password membership. It will work in either Firefox or Chromium forks on any OS platforms; this does require the forks to maintain the WebExtension APIs that 1Password X depends on.

    1Password 7 on any platform will not have the option to disable the code signature for unsupported browsers with our classical desktop browser extensions, we're tightening that up as security continues to evolve and we need to ensure all input/output of 1Password remains secured.

  • MikeT
    edited June 2019

    Hi @kswartz,

    I just double-checked with Waterfox, it's using an outdated Firefox 56 (ESR) build, so 1Password X will not work in there (the WebExtensions stuff we need is in ESR 60). Once Waterfox 68 is released (based on Firefox 68 from what I understand), it will support 1Password X.

    With that, there's no other option to be able to use Waterfox with 1Password 7; you can still use Firefox, Brave, Opera, Vivaldi, and Edge Insider builds with Chromium for now.

  • kswartz
    kswartz
    Community Member

    Okay, so if I've got this right:

    • the old addon will work with old and new versions of Firefox and Chrome, using either 1Password 4 or 1Password 7
    • the old addon will work with other browsers only with 1Password 4 + option to disable signature, and not 1Password 7
    • the new addon (1Password X) will work with any browser supporting WebExtensions (FF ESR 60+), and a 1Password membership (I assume it does not use the desktop app at all).

    If that's true, then that is very unfortunate and it means a membership is not for me right now. I was hoping to use the membership to make 1Password the default choice for my whole family, as I've been using it successfully for years and it's time the kids started using a password manager. But I am, shall we say, the procurement manager of our family, and the decision to remove the ability for users to use custom-built browsers means I can't use my browser of choice, so the membership is no longer cost-effective for us, although there's hope that will change in the future, when Waterfox 68 is GA.

    This is a shame. But I thank you for confirming the details of what was causing the error -- you saved me a lot of potential angst!

  • AGAlumB
    AGAlumB
    1Password Alumni

    @kswartz: Indeed. To clarify, outdated browser and OS versions are not supported by their vendors, and we always recommend staying up to date because that's critical to security -- which is also why we're using 1Password in the first place.

    1Password X works with 1Password memberships and runs in Firefox and Chrome-based browsers (so long as they haven't been modified in such a way as to not support the necessary technologies). This works entirely on its own in the browser.

    The 1Password desktop app/extension works with a license or membership in supported browsers with valid code signing certificates, such as Firefox, Chrome, Brave, Opera, Vivaldi, and Safari/Edge (macOS/Windows respectively). The current version of 1Password will not connect to anything else. The option to disable the security check does not exist in the app.

    Outdated versions of Firefox (or others based on it) are particularly problematic because of the security issues with NPAPI/XUL extensions, which are native code running, not sandboxed, which is why Firefox started moving to WebExtensions a years ago.

    I don't know that it's a sure thing that Waterfox will work later on, but it will be interesting to see, assuming it's updated to support the same technologies Firefox has for years.

    I do think it would be a shame for your entire family to miss out on the security and convenience of a 1Password Families membership -- which, frankly, has made my family's life and mine a lot easier, as far as the simplicity of setup and sharing -- because of your browser preference, but it's up to you I guess. :(

  • kswartz
    kswartz
    Community Member

    @brenty Um...you are making an inaccurate statement here. "[O]utdated browser and OS versions are not supported by their vendors" -- that's true, but Waterfox IS supported by its vendor. It is a fork of another vendor's code, which is now supported by someone else. That's not the same thing, and a bit of an unfair comparison. I can point to dozens of examples of the same thing in software projects everywhere. It's just not supported by 1Password. And I want to be fair here -- that's not an unreasonable position to take for a browser that holds such a small percentage of the market. However, it's not correct to call it "unsupported by its vendor", as the maintainer has been studiously backporting security fixes and features from the original fork, and I would argue it is quite safe to use. (I have not heard of any exploit to which Waterfox is vulnerable that Firefox or Chrome isn't.)

    You also point to outdated versions of Firefox being problematic because of security issues with NPAPI/XUL, but the version of the addon that runs in Waterfox and works with 1Password 4 is a web extension. Although I think that comment is an odd one to make, given you did support it at one time -- why would you have done so if it was that bad?

    If you'd said you don't support Waterfox because it is a niche market, I would not disagree. We all know that risk and accept it. And, again, I want to be reasonable in pointing out that you will support the next release of it. So there's a good chance I'll revisit the membership a few months down the road, if my wife doesn't press me to find another solution sooner. It's a shame the security check was removed -- that would have saved us here. It always troubles me a bit when companies take choices away from users because they believe they can't be trusted not to make a bad decision, but it is what it is.

    Thanks again for the reply.

  • We're aware many of our customers understand these risks and are fully capable of making reasonable choices about disabling security restrictions, @kswartz, but we can't assume that about all of our customers in all circumstances and that's where we run into trouble. When a tool folks rely on isn't working, they often will dive into settings and toggle things on and off in an effort to get it working. In these cases, even folks who are aware of the potential security implications might not be thinking about them at the time – they're just busy people trying to get their work done. I know you've given this particular thing a lot of thought and are making a wholly rational choice based on your threat model, but we still feel the safest thing to do is to enforce these restrictions, even if it means we're taking some options away from folks in your position. If we have such options available, we just can't guarantee they'll only be used with the same thoughtfulness you've shown here.

    Obviously, we'll be thrilled to have you on board with a Family membership when you're ready. We really appreciate the support of folks like yourself over the years and wholly respect your decision to hold back until we're able to support your preferred browser. I am similarly passionate about the browser I use (I'm a Brave gal) and I'd likely make the same choice in your position. Ultimately, 1Password X is meant to be the solution here. It can be installed in any browser that provides the necessary features for it to run properly. At present, I know Waterfox is a bit behind to work well with 1Password X (I actually check it myself periodically because it's one of the more popular of the niches), so it's not a perfect solution but I think it's a good compromise. And, of course, I look forward to it getting up to speed so it (and your family) can join the party. :chuffed:

  • kswartz
    kswartz
    Community Member

    Thank you for the well-considered reply. I agree with you -- 1Password X is a good compromise, and after reading up on it, I look forward to trying it out. I just need Waterfox to catch up, which it will. But I understand your position well -- what you're describing is just a variation of iOS (tight control = less customization/easier to support) vs Android (loose control = more customization/harder to support). Each has advantages, and you went with the former over the latter. It is obviously working out; now I just have to figure out how to jailbreak the 1Password desktop app. ;)

    PS: I'll end on a positive note: 1Password X already works great on Waterfox 68 Alpha.

  • Greg
    Greg
    1Password Alumni

    Hi @kswartz,

    ow I just have to figure out how to jailbreak the 1Password desktop app.

    I would not recommend you to do anything that would compromise the security of your data in 1Password. The safety of your data in 1Password is our top priority and we go to great lengths to make 1Password as secure as possible.

    If 1Password X works in the alpha version of Waterfox, please give it a try and let us know how it works for you. Thank you!

    ++
    Greg

  • kswartz
    kswartz
    Community Member

    @Greg Perhaps you did not see the emoticon, but that was clearly intended to be a joke. (Although now you've perhaps inadvertently confirmed it may be possible....)

    1Password X does work in Waterfox Alpha, but Waterfox Alpha itself is not ready for me to use for daily work, so I can't provide any extended usage feedback just yet.

  • Greg
    Greg
    1Password Alumni

    @kswartz: I noticed the emoji, but decided to warn you anyway. Just in case. ;) I mean, we do not joke with security and safety.

    Hopefully, Waterfox will catch up soon and you will be able to use 1Password X in their stable channel. In the meantime, you can take a closer look at one of the supported browsers.

    Let us know if there is anything else we can help you with, we are here to help. Thank you! :+1:

    Cheers,
    Greg

This discussion has been closed.