Browser extension isn't working on Waterfox
Hello,
I just switched from Firefox to Waterfox today, but it seems the browser extension doesn't want to work, it stays disabled and gray. I don't even have the "browser not signed" warning.
Of course I tried to remove the extension and install it again several times.
I had 1Password 6.8.1 installed, but I rolled back to 6.8 because 6.8.1 removes the browser code signature checkbox (which is unchecked now).
Works on Firefox 55.0.2, not on Waterfox 55.0.2.
I really hope this can be solved.
Thanks.
1Password Version: 6.8
Extension Version: 4.6.10.90
OS Version: 10.12.6
Sync Type: Local
Referrer: forum-search:waterfox
Comments
-
Hi @__Greg - my own installation of Waterfox is currently not playing nice with the 1Password extension as well, so I suspect this is something that's not just you. In the switch-over from web sockets to native messaging although it provides far greater stability and reliability of the extension for filling successfully with signed browsers, it's also tightened up interfacing with unsigned ones. This appears to have affected Waterfox. I can't say when or even whether 1Password extension functionality will be restored in Waterfox, as we're still rolling this out -- and we've never promised compatibility with less well-known browsers (though many have worked and continue to work, on a case-by-case basis). If you're able, I'd stick with Firefox for now, and keep an eye on our updates or check back with us in the future regarding Waterfox.
0 -
Thank you @Lars for your answer.
we've never promised compatibility with less well-known browsers
I understand. I was hoping it was a bit simpler for you, since Waterfox is a fork of Firefox, but I guess it isn't.
Also, since this version of WF now uses its own user profile (not shared with FF, not the same format), changes made to FF won't be reflected in WF if I use it, so I'm kinda stuck with WF now.
Maybe I could install the last version of the add-on that uses web sockets until the problem is solved?0 -
Hey @__Greg - I had a brief chat with one of our extension developers, and apparently the problem for the moment is that the bundle ID has changed, which is along the lines of what I suspected (tightened security around which browsers to "talk" to). Its on our punch list of things to change, but at present we've got more urgent things consuming developers' time. The best I can do for you is to say we'll get to it as quickly as possible, so keep an eye on the updates. Thanks, and sorry I don't have a better answer for you right now.
0 -
You, too! - and thanks for your patience. :)
0 -
Like many others I suspect this is going to be increasingly common an issue - Tab Mix Plus is an absolute must for me, and it's being locked out for the foreseeable future by the move in FF to Web Extensions. That makes Waterfox my main browser. And I'm doing a lot of copy/paste to mimic what the 1Password extension used to just do.
The news that it's on the backlog is most welcome. I'm already getting beta builds so let me know if I can help test or whatever
0 -
I am in the same boat as _Greg and geekzero, so also hoping for a beta that works with Waterfox to be available soon.
0 -
I'm not saying it's easy. It wasn't for us. But WebExtensions is an open standard that anyone can use. Since both Firefox and Chrome are using it, it seems like that's the way forward. We don't currently have plans to support Waterfox, as our focus is on the major browsers. But it's something we can consider. Thanks for your feedback on this!
0 -
Brenty,
Let me start by saying I understand that you only support the major browsers, but (saw that coming, right) it is still a bit disappointing especially as Waterfox is close to Firefox and supports most Firefox extensions. Also, as far as I can tell Waterfox supports WebExtensions, and recently the 1Password icon in Waterfox sometimes goes from being 'grayed out' to 'normal' which seem would suggest it could work on Waterfox.
Is there something in the extension that purposely keeps it from working with Waterfox, or is it simply a matter of being incompatible? The latter seems somewhat strange as the 1Password extension is a WebExtension, right?
Wil Dieteren
0 -
Hi @WilDieteren
1Password checks the code signature of applications attempting to connect, and if the signature doesn't match the pre-determined list the connection is rejected. We are evaluating how we can / if we should allow other applications that are technically capable of handling the protocol connect without exposing customers to undue risk, or adding unwarranted technical complexity to 1Password.
While we don't have any reason to distrust Waterfox in particular there is the strong possibility that if this were more open an attacker could take advantage of that by releasing an app that is less worthy of trust. We certainly want to pay attention to the needs of the more technical crowd who might be inclined to use somewhat obscure browsers, but we also always have the fact that we're responsible for the security of everyone's data in the forefront of our minds.
Ben
0 -
Well phrased Ben, that is a tough balance.
That said, as an idea from the crowd, how about allowing said "more technical" folks to bless an application with however many dialog boxes are needed to make us really really REALLY think about opening up access to all our passwords. Then the burden is on me, not on AgileBits. I'd certainly accept that.
0 -
@geekzero -- it's not a bad idea. Except, here again, YOU would accept it, because you're a smart, technical user...but less savvy users might not even understand the risks properly, or what they were potentially exposing themselves to. And pop-ups in general are something we want to have as few of as possible; they're intrusive, annoying and typically a last resort, from our perspective. We'll add your vote for Waterfox, and I certainly wouldn't say you'll never see this -- but I don't have even the slightest idea when you might see WF added to the list. I know that's a less-satisfying answer that you were probably hoping for, but it's all we've got right now. Thanks for taking the time to share your wishes with us, and enjoy the rest of your week!
0 -
I'd like to add something to this if I may (and add my vote for Waterfox support!)
Waterfox is (in my experience and opinion) a massively superior browser to Firefox, especially now as Firefox is dropping support for a number of older incredibly useful extensions (which, in some cases, are simply no longer being developed and thus will never be replaced). It uses less memory, it crashes less often, it runs faster, and it's just generally better.
"Sticking to Firefox for now" isn't an option. Prior to Mozilla's changes in 55.0, FF and WF shared profile information & could be swapped between at will. The FF55.0 changes forced a profile fork, so switching back to vanilla Firefox at this stage is a tedious & painful process leaving me with a browser that uses more resources, crashes more often, and removes features I value.
Until this change was implemented, I could flip a single setting to make 1Password work with Waterfox. There's a small risk that the developer could choose to intercept my credentials, but the code is open-source - I suspect any such feature would be both hard to find & easily identified - and I can build it myself from the public source tree, ensuring I know exactly what I'm running.
With the inability to disable the signing check, users of non-mainline browsers are effectively forced to either return to using several complex but not unique passwords, or store copies of their 1Password passwords in Waterfox's password vault. Either option defeats the entire purpose of using 1Password or its' competitors; if the pure manual copy-and-paste option was practical, the browser extension wouldn't need to exist.
My personal browser preference aside, the inability to disable this check doesn't seem to result in a real improvement in security. What makes Mozilla trustworthy? Firefox is fully open-source, but we can't be certain that the public binaries Mozilla provide are unmodified from the public code. If I'm concerned enough about security that this might be a problem, as with Waterfox I can build my own copy of FF from the public source tree - Mozilla even provide a handy-dandy compilation guide.
Say I follow this process and build my own copy of FF; the binaries produced at the end won't be signed by Mozilla and will fail your code signing check. Despite being arguably more trustworthy than Mozilla's published binaries, 1Password will not work with this browser; I will once again be left storing my 1Password passwords outside of 1Password, or returning to insecure/nonunique passwords, if I want to be certain that I am running trustworthy browser code.
Even leaving all of that aside, the main reason you've given for removing this option is that people who don't know what it's talking about might turn it on & cause trouble for you if their credentials are compromised as a result. This seems like a bit of a zero-sum game; you could use the same justification to make Watchtower mandatory, make Auto-Lock mandatory, etc etc... Where do you stop?
'Saving users from themselves' aside, Both Apple and Microsoft already have a method of exposing advanced options to users that are not available from within the application UI. OS X's 'defaults' system, and Windows' registry both allow some fairly deep options to be tweaked by users who know what they're doing, and are sufficiently out of reach to uneducated users as to not be a concern.
Can the ability to disable the signing check be exposed via these methods rather than a checkbox in the application UI? Better yet, a mechanism by which we could add code signatures to 1Password's trusted list... Best of both worlds, code signing verification without preventing users from creating their own browsers...
0 -
Hi, @neggles -- thanks for taking the time to write out that lengthy and impassioned plea. If you've been a 1Password user for any length of time, you're probably already aware that we do indeed pay attention to our users' feedback. We don't just read it, either -- quite often, suggestions from the community make their way into 1Password, and we're truly grateful for every bit of feedback we receive -- not to mention feeling lucky to have such an engaged and vocal user community.
I don't even disagree with much of what you've said (we could bring back the
Disable browser code signature verificationcheckbox, you would have an unsigned copy of FF if you built it from source, and most of your other points as well). We actually do make use of Apple'sdefaults writecommand for a few less-frequently requested features that are not potential security issues. And I will certainly add your request for making Waterfox's use of 1Password in the browser possible again. :)From our perspective, there's quite a few things that go into consideration of user requests: what problem does it solve or functionality does it enable? How many users would it affect? How critical is it to the primary functioning of 1Password as a way to securely store important data? Even if we wanted to, it would be impossible to grant all users' requests we receive since some of them are actually contradictory! And that's not even taking into account our own ideas about security usability, convenience and power, or the fact that there are simply limited developer hours in a week.
We try to strike a balance by prioritizing a complex and often tangential set of goals and imperatives: running with the best ideas/most urgent needs, granting users' requests, keeping in mind things like cost and feature creep/bloat and quite a bit more. We are always looking to refine these and make 1Password better. But one thing we've learned over time is that the definition of "better" is rarely the same for ALL users, and we're tasked with keeping all users in mind when we consider changes. Thanks again for taking the time to write all of this up, we appreciate it -- and get in touch any time you have an idea or suggestion...or even a gripe. Have a great week! :)
0 -
Hi @Lars ! Thanks for the reply. You're right - it's not escaped my attention that you guys actually listen to what we have to say, and that's a large part of the reason why I wrote that post in the first place :smile:
Don't get me wrong - as someone outside AgileBits, there's no way I could have the full picture here. I don't know how hard it would be to bring the option to disable back, I don't know the full security implications of doing so, I don't know how hard it would be to implement support for non-mainline browsers (or user-side signature approvals) in a secure fashion; I can probably hazard a guess that the dev team has much more important things to do, though :lol:
I've got enough experience in the world of customer service to know that you definitely can't please everyone all the time, and that the overall security of 1Password as a whole has to come first.
I completely understand your position, and I can't say I even disagree with taking the option away from the main app UI - for the vast majority of 1Password users, that checkbox offered no functionality other than a reduction in security. I would have appreciated some sort of warning - I had been blaming Waterfox for the addon not working, as the checkbox was still present (though apparently nonfunctional!) in the UI until I updated 1Password shortly before writing that post. If there was any warning, I must have missed it, and that's on me I suppose...
Thanks again for taking the time to read & reply to my post. It means a lot to know that you guys are listening, understand that compatibility with browsers other than The Big Four™ is very important to some of us, and that while it might not be very high on the priority list, making it work again is nevertheless on the list :smile:
0 -
Am I reading the comments of the latest 1Password version correctly, in that the extension should now work in Waterfox?
Wil Dieteren
0 -
Hi @WilDieteren -- yup, you read that right. :) Unfortunately, we wrote it wrong! We are indeed working on that currently, but it was NOT released in the current update (6.8.3). Our apologies for the mistake; that must have been confusing to be assured we'd added support back in, but having it still not work!
The silver lining here is that we do indeed have plans to add it back in, it just didn't make it into the current release. So, keep an eye on future updates, and our apologies again -- we've actually edited the release notes to remove this error.
0 -
Thanks for the update. So a good news bad news situation: good news you are working on it (greatly appreciated), bad news it is not working yet. Keep us posted.
Wil Dieteren
0 -
@WilDieteren: On behalf of Lars, you're very welcome. We will be sure to keep you posted.
--
Andrew Beyer (Ann Arbor, MI)
Lifeline @ AgileBits0 -
I'd like to add my voice to the call for AgileBits to provide a means for more technical users to whitelist their own browsers. I use my own customized builds of Firefox that now no longer work with with the 1Password extension. I would love if I could indicate to 1Password that these builds should be trusted.
0 -
Ben,
Any news?
Wil Dieteren
0 -
Nothing to announce at this time. But if Waterfox makes a return, it will likely be in a beta.
0 -
I've been a Firefox supporter since 2005 but as other long-time users note, they've abandoned the features and customization that made them different from other browsers. I've switched to Waterfox and it's almost as good as Firefox used to be...but lacks 1Password integration. I know there are other password services that do work with Waterfox, but hearing that compatibility may be on its way, I'll stick with 1Password. Just adding my voice of support for supporting Watefox, and thank you for your thoughtful replies.
0 -
Likewise, thanks for letting us know you also prefer Waterfox, and it's good to know why as well. :)
0 -
I finally switched from Firefox to Waterfox on my main machine and was sad to discover that the extension didn't work here; this thread has given me hope that Waterfox may be supported. Hopefully this won't hit any roadblocks in development and roll out in a timely manner–until then using a browser without 1Password integration will feel strange and inconvenient. Thank you all for this open discourse and for your work maintaining and improving this great application.
0 -
Likewise, thanks for your feedback on this! Lately most of our time has been spent on supporting all the changes in the big browsers — Firefox and Chrome especially — but hopefully we'll be able to add support for others in the future. Cheers! :)
0 -
v4.6.8 of the 1password extension still works with waterfox 56.0.3. why not just make that available to legacy users instead of forcing v4.6.9?
0 -
@mattyb1 - We don't force versions. You're welcome to grab any version of 1Password extension that suits you. Just be aware that older versions aren't really a solution unless you plan to keep EVERYTHING frozen in time. My own opinion is that if/when you start running legacy versions of anything that's critical to your workflow, eventually it winds up causing more problems than it solves because everything else moves on - hardware, OS versions, software, etc. You can get away with it for a while because even in tech, there's some backward compatibility. But an older version of 1Password or the 1Password extension isn't a permanent solution in the same way and for many of the same reasons that people don't run DOS applications anymore.
We may or may not expand our browser ecosystem to include less-used browsers like Waterfox and some of the many Chrome forks/derivatives. I don't have anything to share on that right now, because frankly, we're focused on the major browsers, as brenty mentioned above, as well as getting the upcoming 1Password 7 ready for prime time. But I will say this much: if you want to guarantee compatibility with the latest versions of 1Password, using one of the major browsers (Safari, Chrome, Firefox) is the way to do it.
0
