ESET Smart Security's Banking Protection does not work with new Firefox 4.6.1 extension
Had some issues getting the new Firefox browser extension 4.6.1 installed. That is now resolved. However, ESET's Banking & Payment protection facility when invoked will not fill in the appropriate fields. See snapshot below. When called up, a separate instance of the browser is loaded, it goes to the website and stops there. It also prevents other logins in to password protected sites in the regular version of Firefox. FF has to be shutdown completely before 1Password will work with other sites.
1Password Version: Not Provided
Extension Version: Not Provided
OS Version: Not Provided
Sync Type: Not Provided
Comments
-
Hi @BobArch2,
That's normal, they're blocking the extensions completely in that mode, which means we cannot work in that mode. Once you exit the banking protection mode, it'll enable the extensions including 1Password. Sometime this does require restarting Firefox completely. This isn't handled by us but by Firefox.
We cannot work around this, it is the intended nature of such protection from ESET. We've seen this via a few other AV tools as well and it has been like this for a few years.
0 -
So, the bottom-line is that if I want banking protection mode offered by ESET, then the only default browser option is Internet Explorer. Firefox is out, Edge is not viable and not too sure about Chrome.
0 -
OK, just confirmed that using Chrome as the default browser, with ESET's banking protection turned on, 1Password will not fill in the required information on the RBC banking site. Same situation as experienced with Firefox.
Internet Explorer is the only viable browser for using 1Password with ESET's banking protection.
0 -
Hi @BobArch2,
That is the unfortunate situation our users find themselves in, correct.
Systems such as ESET's Banking Protection lock out other applications that might play a major part in securing the online life of a user.1Password is one of these apps. By barring access to the localhost IP address 127.0.0.1 while in Banking Protection mode, 1Password can't communicate with the 1Password browser extension in Firefox or Chrome and can't interact with the website, preventing you from using secure filling to enter your login credentials for your site.
I'd recommend you contact ESET and ask them if there's a way to allow the 1Password browser extension to function in Chrome and Firefox while in Banking Protection mode.
If you have any other questions or feedback, please let us know.
Cheers,
Alex
0 -
Hi @AlexHoffmann,
Shortly after my last posting on confirming that Chrome was also an issue, I posted a query on the ESET forum asking for assistance in this matter. I will post their reply here when received.
Thanks for your speedy response.
Cheers,
Bob
0 -
@BobArch2: Likewise, thanks for reaching out. I'll be interested to hear what you learn. And if ESET needs any additional information from us, they can contact us directly at support+windows@agilebits.com so we can see what can be done to help our mutual customers. Cheers! :)
0 -
News FLASH. As a result of the Windows 10 Cumulative update (16.0.14393.321) released today, ESET's Banking Payment and Protection function will not work with the 1Password extension in Internet Explorer. Prior to today, only Firefox and Chrome would not work. Here is a link to the posting I just made moments ago on the ESET support site.
https://forum.eset.com/topic/9772-win10-cumulative-update-16014393321-breaks-bpp/
The problem has been confirmed by at least one other user.
0 -
It was previously reported that 1Password and ESET's BPP would not work in Firefox nor Chrome. It would only work with Internet Explorer. With today's Win10 released updates ESET's BPP will not work with any browser... and the kicker is that 1Password is not the only app having an issue. A user has reported in the ESET support forum that he does not use 1Password and is getting the same issue I posted moments ago on the ESET forum.
1Password Version: 4.6.1.616
Extension Version: 4.6.1
OS Version: Windows 10 Pro
Sync Type: Not Provided0 -
Hi @BobArch2,
Thank you for keeping us posted on this. I've merged both threads into this one to make it easier to follow.
The fact that 1Password doesn't work in Internet Explorer with ESET's BPP feature anymore tells us that ESET is now separately sandboxing Internet Explorer. The 1Password Internet Explorer add-on communicates with 1Password differently than with the extension in Firefox, Chrome, and Opera (they use WebSocket communication at the localhost IP address 127.0.0.1). In Internet Explorer we use the built-in Windows Messaging Service which is considered a fairly secure communication channel and can only be blocked with a certain amount of effort. Whether the effort is worth it is a different question.
Can you send us a link to the other forum post on the ESET site? I might be able to chime in with some information for the ESET team.
Cheers,
Alex
0 -
As requested...
This link is to the general ESET Smart Security segment of the ESET forum:
https://forum.eset.com/forum/23-eset-smart-security-eset-internet-security/
This link is to one of my postings in the forum:
https://forum.eset.com/topic/9754-banking-protection-with-1password-browser-problems/
And this is the second of my postings related to the issue:
https://forum.eset.com/topic/9772-win10-cumulative-update-16014393321-breaks-bpp/
0 -
Thanks Bob!
We've been in contact with ESET and started discussing a few of the issues brought up by you and a few others on the forum.
Preliminary findings on my testing setups confirm that ESET Smart Security works very well with 1Password except in two areas: Installing the Firefox add-on and Banking and Payment Protection.I'm going to do a few test of my own and I'll chime in on the active thread in the ESET forum just in case.
If you have any updates, please let us know.
Cheers,
Alex
0 -
Hi Alex,
I noticed that a couple of ESET users posted an update that ESET's BPP is now working in Internet Explorer.
I turned ESET Banking Payment and Protection back on and can confirm that it is now working with 1Password and Internet Explorer v11. No updating of Windows, ESET or 1Password has occurred in the last 24 hours. Meaning, I'm not sure what triggered the success. Perhaps playing with the turning off/on/off/on feature of BPP was the answer.
I have not tested using Firefox and Chrome but based on previous comments by ESET support, I doubt that it is working.
Cheers,
Bob
0 -
Hi Bob,
I believe you're right about that. The comments from the ESET moderators suggest that, too. I had a great call with someone from ESET yesterday and today and we've started the process of working this out our shared customers.
This is pure speculation on my part but I'd wager that ESET has allowed inter-process communication via the Windows Messaging Service in Internet Explorer again through a silent update and that's why 1Password works in there again.
Anyway, I still haven't posted in the ESET forum but will do so after I've given their current version another look-over tomorrow with one of their support engineers.
We'll keep you posted!
Cheers,
Alex
0 -
Hi Alex,
Any update on 1Password working in Firefox with ESET Smart Security BPP?
Cheers,
Bob
0 -
Hi @BobArch2,
No updates yet but it is not supposed to work in Firefox or Chrome, only in Internet Explorer because of the way add-ons work in Internet Explorer is different from extensions in other browsers.
We'll reach out to them to see if they have a workaround for us to use. /cc @AlexHoffmann
0 -
@BobArch2: I just wanted to follow up to let you know we've been working with ESET on this, and while we don't have what we'd consider a permanent solution, there's a workaround that can help in the mean time.
ESET scans the 1Password browser extension during download (after you click the Install button on https://agilebits.com/onepassword/extensions) and quietly prevents the download of the extension from finishing (due to a false positive). The same happens when your browser attempts to automatically update the 1Password browser extension.
While we work with ESET to find a better solution, you can allow the 1Password browser extension to be installed or updated by doing the following:
- Open your ESET anti-malware program.
- Select Setup > Advanced setup > WEB AND EMAIL > SSL/TLS.
- Click the Edit button next to "List of known certificates" and the Add button in the "List of known certificates" window that opens.
- Click the Add button in the "Add certificate" window and then click the URL button next to "Import certificate from".
- Copy the following address, paste it into the text field in the "Load certificate from URL" window, and click OK:
d13itkw33a7sus.cloudfront.net - Select Auto for "Access action", Ignore for "Scan action", and click OK to confirm the setting in all windows.
In our testing, this has helped. Please let us know how it turns out!
0 -
@brenty Not sure if your workaround was meant to add the Firefox extension to the normal Firefox browser or to the ESET BPP Firefox browser. Regardless, I did follow your instructions to allow the 1Password browser extension to be installed by adding the certificate information in ESET's Advanced settings. Please note that i did have v4.6.1. of the extension as far back as October 8, 2016 but I reinstalled it today without any issues.
The regular version of Firefox (v49.0.2) does show that the extension has been installed and is working as needed for non banking sites controlled by ESET BPP. However, the browser extension is not available for the ESET Secured Firefox browser (v49.0.2). As such, Firefox using ESET BPP is not functional. I will continue to use IE as my default browser until such time as ESET and you folks can come up with a solution.
As a side note, ESET are preparing to release v10 of Smart Security within the next few days to the general public. It has already been released in a few market areas.
0 -
Hey @BobArch2,
Thanks for this. Yes, there was a small mix-up: Brent didn't realise that yours is a separate issue. However, this gives us a new bit of information about the BPP feature that's quite useful.
We'll continue to hammer away at this with ESET and I'm going to let you know once we have news.
Cheers,
Alex
0 -
@AlexHoffmann @brenty All is well in the world!
As last reported on October 23, 2016 there were still problems with the Firefox (v49.0.2) / 1Password Browser Extension (v4.6.1) while using ESET Banking Payment and Protection. The browser extension could not be loaded in the BPP version of FF.
I also indicated at the time that an updated version of ESET was on the horizon. Available in some markets but not in North American.
Yesterday, Saturday I tried updating my ESET Smart Security v9.0.406.0 to the new release using the update feature within the app. No go. So went onto the ESET web site, found the live installer and updated ESET Smart Security to v10.0.369.0.
Today, Sunday, I switched my default browser from IE to Firefox. All was working fine with the regular version of FF (the 1Password icon was present). Then brought up the ESET BPP version of FF... the 1Password icon was not present. Went to the AgileBits web site and downloaded the FF browser extension. It needed permission to install and when approved, it installed without an issue. The 1Password icon appeared and I was able to log onto my banking sites.
Not sure if it was the newer version of ESET or your recent dealings with ESET that made it work, but all is well.
Cheers,
Bob
0 -
Excellent! Thanks for the update, Bob! We haven't made further big changes since 4.6.1, and it sounds like they were able to have version 10 be more accommodating to the 1Password extension.
I'm glad to hear it's working for you now, and I appreciate you following up for others who might have similar questions. It sounds like you should be all set, but don't hesitate to reach out if you need anything else. Cheers! :)
0 -
Just to add to what Brenty said:
I made my contacts at ESET aware of the issues and threads on ESET's site you brought to our attention but apart from confirming your findings, our work with ESET is focused on reducing the issues when installing the 1Password Firefox extension.
I think it's safe to say that the fact this feature works with 1Password now is your and other users' accomplishment.
So: Thank you!
0 -
News Flash: just updated ESET Smart Security to v10.0.386. ESET's Banking and Protection Payment does not allow the 1Password Browser Extension (v4.6.1) in ESET's secure version of Firefox. The 1Password Browser Extension does work in the normal Firefox browser (v50.0.1) but does not allow going to a banking site. Will try some of the previous workarounds to see what happens.
0 -
OK, got it working. Followed Brenty's instruction to load the certificate in ESET Advanced setting (from October 2016)...
Copy the following address, paste it into the text field in the "Load certificate from URL" window, and click OK: d13itkw33a7sus.cloudfront.net
Select Auto for "Access action", Ignore for "Scan action", and click OK to confirm the setting in all windows.Could not add the browser extension (v4.6.1) into Firefox in the normal manner. Luckily, I still had the 1Password-4.6.1.xpi file from October. Was able to manually add it to the extension table.
All is well.
0 -
Problem has resurfaced with update to Firefox v53.0 64bit. 1Password is v4.6.1.620.
Firefox v53.0 has auto disabled 1Password and it cannot be re-enabled. I tried to reinstall the 1Password extension. Will not allow the reinstall with a final message that the connection could not be made.
Any suggestions?
Cheers,
Bob
0 -
Hi @BobArch2,
That error message means your security tool is blocking the installation, did you try the previous trick with adding the certificate from Cloudflare mentioned here.
If it doesn't work, try the alternative installation method here:.
0 -
My edition of ESET Smart Security (v10.0.390.0) did have the CloudFront certificate before the issue. Regardless, I deleted that certificate and re-entered it in the prescribed manner. That action had no impact on the problem.
I followed the alternative installation method. My previous extension was version 4.6.1. The new one is 4.6.4. Albeit that the new extension could install in the Firefox v53.0 browser, and was functional, the Banking Protection provided by ESET using the special Firefox Browser would not function. Trying to add the 4.6.4 extension to the Banking Protection browser said that 4.6.4 was corrupt.
I tried a complete uninstall of the 1Password extension in Firefox. Restarted the system, performed a new install of the 1Password extension and tried again. No happy results.
I tried turning off the Banking Protection feature in ESET Smart Security and was able to sign into my bank using the Firefox v53.0 without any issues. But that of course removes added protection for banking sites.
With Banking Protection turned on, I then tried loading the normal Firefox browser and selected my bank from the 1Password menu. That action automatically brought up the "secured" browser but did not automatically fill in the fields. Neither did the secured browser have the 1Password icon. See the attached snapshot for a visual of this last attempt.
0 -
Hi @BobArch2,
That is intentional, you are asking ESET to protect you when you're on a bank site and the way it does this is to sandbox the window so that no external factors can access it, including 1Password. There is nothing we can do, we will not violate the ESET security to make 1Password work in there.
Just to be clear, if your system is compromised to the level that you need this ESET protection, your 1Password data would not be safe either, nothing is.
0 -
Sorry MikeT, I cannot accept your answer. There has to be other reasons. Everything has been working since a similar problem was first raised October 2016 and resolved. The only thing that changed was when Firefox was updated from v52.0.3 to v53 this morning. Thursday, April 20, 2017.
I am not saying that 1Password is at fault. I am saying that a combination of Firefox v53, ESET Smart Security v10.0.390 and 1Password v4.6.1.620 with browser extension 4.6.1 through 4.6.4 do not work together.
I no longer use Internet Explorer (v11) and do not wish to revert to IE11 but I could try to test the function.
I also have Chrome and I will test that browser with 1Password.
I also have Edge but did not continue to use it when it did not allow extensions several months ago. Just for laughs, I will see if there are any issues like with Firefox.
And as I previously reported to you good folks a few weeks back, a future version of Firefox (v57) will no longer allow extensions. Perhaps there will be some exceptions but I am not privy to that knowledge.
0
