Waterfox Identified as "Explorer" in latest Beta 7.0.540 [Waterfox is not supported anymore]

cs88rf

Right after the update of 7.0.540, I found that in Waterfox (a fork of Firefox pre-quantum) I can no longer use short cut key to fill any form. So I went into 1P's setting to check on the connected browsers, it looks like it used to be identified as Firefox, but now it's "explorer by Microsoft Windows (paired)". I don't mind this unless it's connected to the problem of the shortcut key no longer working.

Could this be a problem of the browser extension or the 1P app itself?

Thanks!

---

1Password Version: 7.0.540
Extension Version: 4.7.1.3
OS Version: Win10 Pro 1709
Sync Type: Not Provided

cs88rf

Also, in 1P mini, called up by the 1P icon in the browser, at the bottom it says "filling in explorer for xxxxx.com". Lucky thing is it can still detect the web page and show the matched password.

MikeT

Hi @cs88rf,

Thanks for reporting this.

Firefox or other browsers that is based on it, uses Explorer to launch the 1Password's Native Messaging Host process, so that the 1Password extension can connect to it directly. This is somewhat normal. We're trying to find a better way to detect who launched Explorer.exe.

However, just a heads up, we will be removing support for Waterfox from 1Password 7, we will only support stable versions of Firefox, Chrome, Vivaldi and Edge. We will not be supporting third party derivatives, instead 1Password X extension will be used for these browsers. We have a beta version of 1Password X for Firefox out at the moment and hope to ship it soon.

cs88rf

That's sad, because firefox 58+ no longer supports several essential extensions for me so I had to start using waterfox.

Anyway, is this changed in the latest update or something? Prior to the update over the weekend, waterfox was always identified as firefox in the "browsers" setting menu and also in the 1P mini.

cs88rf

Updated to 7.0.541 just now ... the worse happened - Browser connection refused - 1password refused connection from untrusted source

Now 1P is totally unusable

MikeT

Hi @cs88rf,

I am sorry but some features, we have to consider security more importantly. As browsers and the web are the most hostile environments there are now, we have to be stringent about this. One browser was compromised, one was later sold and so on, we just have no idea if they're trustworthy over time. The security of the browser extension and the connection between it and 1Password is dependent on the browser, something we can't fully control except to only allowed verified trusted vendor certificates.

I am hoping we'll find a better way and for me personally, I'd like to see an option to disable this setting but every setting we add has its costs too.

cs88rf

Looks like the whole situation started with 7.0.539. For now I've had to roll back to 7.0.532 to continue using it normally.

Is there any info on the technicality? I could always try to consult with the forker to see if there is any plan to comply with the security requirement of 1P. It is unclear to me as to why the shortcut button stopped working at first, and then another update totally broke the connection between the browser and 1P.

MikeT

Hi @cs88rf,

Yes, we've started by pruning and updating our browser certificates list in the 7.0.539 update:

Pruned the old browsers from our extension support list. {OPW-1885}

What happened afterward was a bug, we didn't remove the Microsoft certificate on the Explorer.exe that was involved with Firefox and other browsers, so they could still technically use this to send information but not backward. In fact, that is one of the issues with having a long list of certificates, anyone can get in if they have the right certificate.

Is there any info on the technicality? I could always try to consult with the forker to see if there is any plan to comply with the security requirement of 1P.

This isn't something they can do on their side, this is an opinionated decision on our side.

cs88rf

I see. Thanks for the explanation. Guess I'll need to start hunting for replacement extensions on Firefox Quantum while I stay with 7.0.532 for now.

MikeT

Hi @cs88rf,

You might want to check out the subreddit, /r/Firefox, they often have folks helping each other find better replacements.

cs88rf

Still no replacement for TMP, crazy Mozilla, guess I'll have to stick with Waterfox for now.

I signed up for 1P X beta, hope to get the link for it soon!

MikeT

Hi @cs88rf,

Can you email us at support+windows@agilebits.com with your forum username and the link to this thread included? Let me know when you sent it, so we can confirm we got your email.

cs88rf

Mike, is it for the 1P support of Waterfox or for the matter of 1P X? If the latter, I just received a download link, but it looks like it's for Firefox 60+ only? Waterfox is based on 56 at the moment.

MikeT

HI @cs88rf,

For both, I was going to ask about Waterfox update status since Firefox is on 59 and we're not yet there with stable compatibility for 1Password X. That's another reason we have to be careful with third party browsers, they may stay behind with security issues when they're disclosed in new versions.

cs88rf

Just sent the email.

I've tried both IPX 1.6.3 and 1.6.7 and so far it's a no go

AGAlumB

@cs88rf: Indeed, I'm really sorry for the confusion there. As I mentioned in the other discussion, Firefox is only just getting what we need in version 60 (currently in beta), and Waterfox is much farther behind that. I do hope we'll have a version of 1Password X which will work in more browsers in the future, but we need to focus on getting it working in the major ones first. :blush: