User avatar
🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca
6d
Second update: Yes, this is pointless security theatre. Any addon can download and execute remote code. So even if you do all of the work I mentioned, unless you audit the code, you still have no idea if the addon is safe or secure. This just gives users a dangerously false sense of security. The only way it would be meaningful is if NVDA code signs all addons, disables remotely downloading files, and only allows approved addons through the store. And doing this would be far, far worse than the alternative. It would mean, for one, that Eloquence would be completely dead as an NVDA addon. NVDA doesn't allow it in the addon store, and thus wouldn't sign it.

Update: it looks like the outreach to virustotal.com in my firewall logs was unrelated to NVDA. Based on a look at: github.com/nvaccess/nvda/blob/master/source/addonStore/models/scanResults.py

NVDA just accepts whatever the addon manifest says without verification. So instead of a privacy violation, this is just pointless. I can put whatever I want there in my addons, and it'll reassure the user that no viruses were found. To actually know the truth, a user has to:
* visit the URL
* hash there addon
* compare the hashes

And only then can they know if the results in the virustotal URL they visited are the same ones for the addon they installed, and that the information in the manifest is correct based on the actual virustotal.com findings.

By the time you do all that, either Windows Defender has flagged the virus, or you're already screwed.

I guess I'd rather pointless security theatre than privacy violation, if I have to choose. But can't I have neither?

It looks like in the latest alphas, it's now sending all of your addons to be scanned by VirusTotal. I did not give permission for this, and I do not want this. How long until NVDA stops addons it doesn't approve from running at all? For now I have virustotal.com blocked at the router. There seems to be no other way to block this.
'scanResults': {'scanUrl': 'www.virustotal.com/gui/file/2a83b713e38596cfbcb3f98b5eb91530ddfd0e9319907c6119cbbbe08f7acc88', 'malicious': 0, 'undetected': 67, 'harmless': 0, 'suspicious': 0, 'failure': 0, 'timeout': 0, 'confirmedTimeout': 0, 'typeUnsupported': 9}}
Traceback (most recent call last):
File "addonStore\models\scanResults.pyc", line 31, in fromDict
KeyError: 'virusTotal'
9
13
4
0
User avatar
MostlyBlindGamer @MostlyBlindGamer@dragonscave.space
6d
@fastfinge well, I figure I’d end up cloning the repo at some point.

The scan results object (including URL) is part of the add-on view model. Without forcing myself to read more Python, but also having noticed that object is deserialized from JSON, it seems most likely that the store server sends the client the fully auditable virus scan results.

Did you find any communication to VirusTotal in your logs?
2
0
0
0
User avatar
🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca
6d
@MostlyBlindGamer I did. It could have been unrelated; there's a lot of stuff going on this network. But what would be the point of just including the URL to the results? I can just put anything I want in the manifest and say it passes. For it to mean anything, NVDA has to reach out and check. So this is either a privacy violation, or total security theatre. Not good either way.
1
0
0
0
User avatar
MostlyBlindGamer @MostlyBlindGamer@dragonscave.space
6d
@fastfinge who puts it in there?
If it’s the developer, I’d check server-side, before making it available in the store. I don’t have a problem with sharing the URL with the client for transparency and auditing.
If NVDA do the check, that would only be server-side.
There’s no reason to have all the clients hammering VirusTotal servers.
I’d run a packet sniffer and navigate through the store to confirm the possibility that they’re doing something very silly.
2
0
0
0
User avatar
🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca
6d
@MostlyBlindGamer I don't even know why they're doing this. If you don't have a virus scanner enabled on your computer, this will not save you. Any addon can just download remote code whenever it wants to. That is, in fact, how most addon update checkers work. So even if you audit the results, it's completely meaningless unless you also audit all the code. The only thing this does is give users a false sense of security.
1
0
0
0
User avatar
MostlyBlindGamer @MostlyBlindGamer@dragonscave.space
6d
@fastfinge it’s about the [puts on sunglasses] optics.
[The Who blares in the background]
1
0
1
0
User avatar
🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca
6d
@MostlyBlindGamer Yeah, but I know you've deceived me, Now here's a surprise. I know that you have, 'Cause there's magic in my eyes. I can see for miles and miles, And miles and miles...
1
0
1
0
User avatar
MostlyBlindGamer @MostlyBlindGamer@dragonscave.space
6d
@fastfinge not the same CSI, but very appropriate.
0
0
1
0