{"id":1005577,"authors":[{"id":14360741,"name":"Anon","url":"https://addons.mozilla.org/en-US/firefox/user/14360741/","username":"anonymous-abea0fc43d61bb377f812382473510e9","picture_url":null}],"average_daily_users":15,"categories":["privacy-security"],"contributions_url":"","created":"2018-10-23T16:54:37Z","current_version":{"id":5744084,"compatibility":{"firefox":{"min":"62.0","max":"*"}},"edit_url":"https://addons.mozilla.org/en-US/developers/addon/anti-mitm-tlscaptcha-poc/versions/5744084","file":{"id":4288383,"created":"2024-05-17T13:06:07Z","hash":"sha256:c27f82274576b59221093b167eedc4ae271ce831b5099099d3918174a54592ee","is_mozilla_signed_extension":false,"size":14256,"status":"public","url":"https://addons.mozilla.org/firefox/downloads/file/4288383/anti_mitm_tlscaptcha_poc-1.0.3.xpi","permissions":["cookies","tabs","webRequest","webRequestBlocking","webRequestFilterResponse","webRequestFilterResponse.serviceWorkerScript","https://*/*","http://*/*"],"optional_permissions":[],"host_permissions":[],"data_collection_permissions":[],"optional_data_collection_permissions":[]},"is_strict_compatibility_enabled":false,"license":{"id":6,"is_custom":false,"name":{"en-US":"GNU General Public License v3.0 only"},"slug":"GPL-3.0-only","url":"https://spdx.org/licenses/GPL-3.0-only.html"},"release_notes":{"en-US":"~ Content script is no more.\n~ Works properly with 'insecure context'.\n~ Breaking change: only PBKDF2 is supported as verification hash.\n+ Experimental feature: encrypted content support."},"reviewed":"2024-05-17T13:10:15Z","version":"1.0.3"},"default_locale":"en-US","description":{"en-US":"Every time when you solve CAPTCHA, the CAPTCHA answer can be used as a common secret for a short time. Mainly, It can be used to prevent TLS certificate spoofing.\n\nSince ordinary web pages (and their JavaScript) doesn't have access to TLS certificate data, I was have to make this extension. Actually it does the following:\n\nlet clientsideDigest = <Digest of TLS certificate that you get from website you're visiting>;\nlet yourAnswer = <Your CAPTCHA answer>;\nlet resultDigest = PBKDF2(clientsideDigest, \"SHA-512\", yourAnswer); \n//Where yourAnswer is PKBDF2 salt.\ncookies[\"TLSCaptcha\"] = representAsHexString(resultDigest);\n\nTo see it in action, you need to visit a website that have server-side implementation of this scheme.\nAt the moment of publishing this extension, there is no server-side implementations. If you want to make your own, please look into source code for details.\n\nNew additional featue: you can use this addon to establish additional encryption. See source code for details."},"developer_comments":{"en-US":"At the moment of publishing this extension, there is no server-side implementations. If you want to make your own, please look into source code for details. It's very simple to understand.\n\nWARNING: this extension cannot be ported to Chromium-based browsers due to API limitations."},"edit_url":"https://addons.mozilla.org/en-US/developers/addon/anti-mitm-tlscaptcha-poc/edit","guid":"TLSCAPTCHA@anon","has_eula":false,"has_privacy_policy":false,"homepage":null,"icon_url":"https://addons.mozilla.org/user-media/addon_icons/1005/1005577-64.png?modified=0caf62c3","icons":{"32":"https://addons.mozilla.org/user-media/addon_icons/1005/1005577-32.png?modified=0caf62c3","64":"https://addons.mozilla.org/user-media/addon_icons/1005/1005577-64.png?modified=0caf62c3","128":"https://addons.mozilla.org/user-media/addon_icons/1005/1005577-128.png?modified=0caf62c3"},"is_disabled":false,"is_experimental":false,"is_noindexed":false,"last_updated":"2024-05-17T13:10:15Z","name":{"en-US":"Anti-MitM TLSCAPTCHA (PoC)"},"previews":[],"promoted":[],"ratings":{"average":3.0,"bayesian_average":2.0783338210081728,"count":2,"text_count":1},"ratings_url":"https://addons.mozilla.org/en-US/firefox/addon/anti-mitm-tlscaptcha-poc/reviews/","requires_payment":false,"review_url":"https://addons.mozilla.org/en-US/reviewers/review/1005577","slug":"anti-mitm-tlscaptcha-poc","status":"public","summary":{"en-US":"This extension uses your CAPTCHA answer to verify TLS certificate that you get from website you're visiting. \nWarning: you can see it in action only if a website has server-side part of such verification scheme."},"support_email":null,"support_url":null,"tags":[],"type":"extension","url":"https://addons.mozilla.org/en-US/firefox/addon/anti-mitm-tlscaptcha-poc/","versions_url":"https://addons.mozilla.org/en-US/firefox/addon/anti-mitm-tlscaptcha-poc/versions/","weekly_downloads":0}