I want to make a browser extension available to users. Can I sign my extension so that users can verify it is authentic, without needing to trust the web site where they got the extension from nor the security of their network connection? Which browsers support signed extensions that are easy for users to verify?
- Firefox: Yes. Sign your
xpisign.py(with a certificate from a trusted issuer, such as Verisign).
Integrity: Firefox will report a corrupt add-on if the hashes do not match.
Verification: The user just needs to see if the add-on installation prompt says "Name of extension (developer name)" instead of "Name of extension (author not verified)"
- Chrome: Yes. The
.crxfile is a zip file preceded by a public key and zip content's signature.
Integrity: Chrome will abort the installation and show
CRX_SIGNATURE_VERIFICATION_FAILEDif the extension's signature is invalid.
Integrity: (alternative method) Cut the headers from the crx file, and extract the public key and signature. Check if the signature is correct.
Verification: Check if the public key matches with your key.
- Opera: The
.oexfile (=a plain zip file) cannot be signed.
Opera 15+: The
.crxfile has the same format as Chromium's
Safari: You can only install a Safari extension if it's signed with a key which matches a certificate which is signed by Apple. More info on signing
Integrity: Safari refuses to install invalid extensions.
Verification: Extract the certificates from the extension using
xar -f path/to/name.safariextz --extract-certs output_dir. Then check if the first certificate (
output_dir/cert00) is identical to the developer's certificate (or at least check if the properties (such as the Developer's ID and name) are plausible).
Internet Explorer: The "extensions" are
.dllfiles (BHO, accelerators, ...) which can be signed, using Microsoft's
Verification: Look at the properties of the file, and check if the signature is deemed valid by Windows.
(NPAPI) plug-ins: The plug-in's binaries can be signed.