Unverified author for Firefox Extension

mr.bailey
mr.bailey
Community Member
in Mac

I use 1Password for Mac v5 and Firefox. I received notification that a 1Password extension for Firefox was available. Stepping through the installation I was stopped cold when I read that the author was unverified. I didn't continue. I spent several more minutes determining whether this extension was real. If it were for - I don't know, Pinetrest or Epicurious or the like, I might be inclined to look past the warning. But this links directly to software that guards my identity, finances, and remote server access. Why isn't the author verified? This little notice should be as important to 1Password users as an SSL certificate is to Vanguard Investor.

I'm using Firefox 36 on OS X 10.10.2

Comments

  • Stephen_C
    Stephen_C
    Community Member

    I have no idea why you got that message. I'm also using FF 36 and 1P5 on OS X 10.10.2 and update my 1P browser extension automatically. (I'm actually using the beta browser extensions so updates are pretty regular.) I have never had that message.

    It would be helpful if you explained a little more about what happened.

    I received notification that a 1Password extension for Firefox was available.

    I assume you mean a Firefox notification, is that correct? (I ask only because I've set extensions to update automatically so I'm not seeing those notifications.)

    Stepping through the installation

    When exactly did you get the message and what exactly was the message? A screen shot might help if it happens again. You could, of course, try removing any 1P extension then going to 1P5 > Install Browser Extensions... and see if it happens again. I'd very surprised if it did.

    I'm not for a moment denying that you saw what you saw. :) It's just extremely odd nobody else has reported anything like that.

    Stephen

  • littlebobbytables
    littlebobbytables
    1Password Alumni

    Hi @mr.bailey,

    You're right on both counts. It does do this and we should do better. When you install the extension our own page's screenshot also shows the author as unverified. This is something we need to address and I apologise for the concern it has caused. If the address you're seeing when you try to install the extension is https://d13itkw33a7sus.cloudfront.net/dist/1P/ext/1Password-X.X.X.xpi then I can confirm that is us (although that does rely on you having faith that the address isn't being spoofed or you're subject to a man in the middle attack. The forum will want to display that as a link but it won't lead anywhere as I've substituted the numbers for Xs. I do apologise.

    ref: OPX-29

This discussion has been closed.