download_extension.mdwn 3.54 KB
Newer Older
1
[[!meta title="Automatic ISO verification extension for Firefox"]]
2
3
4
5

We are planning to create a custom Firefox add-on to download and verify Tails
using SHA-256 checksum.

Tails developers's avatar
Add TOC  
Tails developers committed
6
7
[[!toc]]

8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
Objectives
==========

  - To fix the ISO verification method using Windows. It has been broken since
    Firefox 20.
  - To simplify the installation process by automating some ISO verification
    during the download process.

This would fix the main stumbling block for Tails verification (and thus
installation) for the vast majority of users.

Security considerations
=======================

  - People are downloading their ISO image from one of our mirrors. Those
    mirrors are run by volunteers and the content of what they serve is not
    authenticated.
  - On the other hand, the information served on tails.boum.org is
    authenticated through HTTPS.
  - Downloading Firefox and installing add-ons is also done through HTTPS on
    mozilla.org.
  - Forcing Firefox users who are downloading the ISO image through HTTP to
    verify its checksum can only increase the average level of verification
    that people do on Windows and Mac OS systems.
  - But HTTPS does not provide strong authentication. So our documentation
    should make that clear and keep providing instructions for authentication
    using OpenPGP but as an additional check.

Scenario
========

ISO download
------------

  - When the user clicks on the direct download button from the [[download
    page|download#index2h1]], Firefox proposes to install the extension.
  - The user allows the installation of the extension.
  - The extension starts the download and the user decides where to save it.
  - The webpage is modified and displays a progress bar of the download.
  - The user might or might not close the webpage.
  - The download also appears in the usual list of downloads of Firefox.

ISO verification
----------------

  - When the download finishes, the ISO verification starts.
  - The extension checks the size of the download to verify that the download
    was complete.
  - The extension compares the checksum of the ISO image to a checksum found on
    the website through HTTPS.
  - The extension displays the result to the user:
    - If the original webpage is still open, it now either:
      - Points the user to the installation documentation.
      - Proposes troubleshooting strategies.
    - Otherwise it shows the result in a popup message and points to the
      appropriate page.

Other desirable features
========================

  - Be able to use that extension, once installed to verify ISO images
    downloaded using BitTorrent for example.
  - Be able to use that extension to verify other ISO images, testing images,
127.0.0.1's avatar
127.0.0.1 committed
71
    older ISO images, etc. In that case the user would be warned about the
72
    deprectated or experimental status of the ISO image.
73
74
75
76
77
  - Be able to use that extension to check the GPG signature. On top of
    verifying the checksum, this would provide TOFU authentication. Then, if the
    user downloads a genuine app and a genuine key on first use, then she will
    be protected from a later compromision of the HTTPS certificate of
    tails.boum.org.
78
79
80
81
82
83
84
85
86

Technical insight
=================

  - That technique should be multiplatform and work from TBB as well.
  - The extension can get the checksum and the URL of the ISO image from the
    `<div id="content">` in following static pages:
    - <https://tails.boum.org/inc/stable_i386_iso_url/>
    - <https://tails.boum.org/inc/stable_i386_hash/>
Tails developers's avatar
Tails developers committed
87
88
  - The same tricks should be used to get the file size.
    See [[!tails_ticket 7417]].