1

We want to verify that only our devices can use our extension, therefore devices need to give an ID and be put on our allowed list.

Similar questions have been asked before, and the answer boils down to "extensions can't access a unique device ID" - privacy concerns. The given alternative is storing some data, but this isn't useful for shared devices where multiple accounts are expected to have the extension with a single device ID.

However, our extension is used on devices in our business that IT can put files on. For example, C:\Program Files\Mozilla Firefox\distribution\ contains policies to auto install our extension, and I can add files here without non-admin users being able to edit/remove.

Is there a way to put our own device signatures in the distribution/install folder and then have an extension read it?

Improve this question

1 Answer 1

Reset to default
1

What you're trying to do is authenticate the machine apparently to the extension.

Extensions cannot read the filesystem directly. If they could, then malicious extensions (which are really just JavaScript with some special APIs) could export sensitive files to the Internet. JavaScript can read the filesystem through an interactive file picker, but I don't think that's the user experience that you want.

I think the answer lies in another direction, although I haven't tried it myself, so this is a suggestion rather than an answer.

I think you might have more success investigating whether you could leverage the operating system's digital certificate store. Then the problem becomes one of verifying that the machine has the certificate's private key in non-exportable storage. (Can the machine verifiably sign a random challenge? Is the certificate authority the company's CA? Things like that.)

Presumably all users would have their own logins. That would make the new questions be:

  1. Does the OS support client certificates that are per machine rather than per user?
  2. Does the OS support client certificates that are not password protected (because you don't want users to have to enter a password to authenticate the machine)?
  3. What do you want the properties of the client certificate to be (unique per machine vs the same one everywhere, valid lifetime/expiration, etc.)?

Since these certificates would be internal use only, you may not need to spend money on a lot of certificate infrastructure, but that depends on the size of your enterprise.

In any case, I think we are way beyond the scope of an Internet bulletin board. It becomes a question about issues other than how to write Firefox extensions.

Improve this answer
Sign up to request clarification or add additional context in comments.

Comments

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.