Quote:
Originally Posted by pjwalsh
So.. does the extension do it securely?
|
My understanding of the issue is that the browser has to connect to the USB system in order to communicate with the U2F device. If this isn't done carefully, then it might be possible for arbitrary Javascript code to talk to any of your USB devices - disks, network devices, etc.
This is easier for Chrome to protect against because it already has its sandboxing model where as a last line of defence, Javascript can't do anything outside of its running context (usually the current tab).
Mozilla doesn't have this sandboxing model, mostly for legacy reasons, so the USB supports needs to be implemented very carefully. It can't afford to be wrong as there isn't that last line of defence.
The (long) dev discussion is here:
https://bugzilla.mozilla.org/show_bug.cgi?id=1065729.
Back to your original question about the extension. I don't know anything about it really, and I'm not a Mozilla user, so I can't really say anything about its security characteristics. If its implemented the way that seems obvuous to me (a secondary task using libu2f-host to communicate with the U2F device) then it's probably not too bad and I would probably use it.
Ultimately though you don't really have much guarantee about anything unless you're willing to go to a lot of effort. Chrome could be broken for all I know. I trust my browser because the alternative is more effort than its worth. You know your own security needs, so you'll need to make the best choice for yourself.