Browserpass does not unlock GPG keys in Firefox + GNOME 3

[nonnymoose]

General information

• Operating system + version: Arch Linux
• Browser + version: Mozilla Firefox 68.0.1, Mozilla Firefox Developer Edition 69.0b8
• Information about the host app:
  • How did you install it?
    Installed via a package manager
  • If installed an official release, put a version ($ browserpass --version): 3.0.6
• Information about the browser extension:
  • How did you install it?
    Installed via a package manager
  • Browserpass extension version as reported by your browser: 3.1.1

---

Exact steps to reproduce the problem

1. Configure pass to use a password-protected GPG key (pass init id_of_password_key)
2. Install browserpass and browserpass-firefox
3. Create at least one entry in the pass store
4. Do not unlock the GPG key, or, if you have already, kill the gpg-agent process
5. Go to a website that corresponds to an entry in the pass store
6. Attempt to autofill a login, copy a password, or copy a username

What should happen?

Note: this does happen in Chrome(ium)
The gpg-agent pinentry dialog should appear and allow the user to unlock the key. If they unlock the key successfully, browserpass should complete the requested action. Otherwise, it should report an error.

What happened instead?

In Firefox, browserpass simply displays e.g. "Filling login details" for a fraction of a second, and then fails silently and does not complete the action.

[maximbaz]

Hey, browserpass is not doing anything to unlock the keys, it simply calls gpg process to decrypt the file. Something must be off with your gpg or gpg-agent configurations...

try to launch Firefox from terminal, would that help?

[nonnymoose]

I launched Firefox from the terminal and nothing changed. There was also no output on the terminal.

At first, I was certain it was a problem with my configuration, but I tested it on Chromium and it worked just fine. Does the native host connector do anything different with Chromium vs. Firefox?

[nonnymoose]

Here is my personal gpg configuration:
dirmngr.conf:

keyserver hkp://jirk5u4osbsr34t5.onion
keyserver hkp://keys.gnupg.net
honor-http-proxy

gpg.conf:

keyserver hkp://keys.gnupg.net
cert-digest-algo SHA256
no-emit-version 
no-comments 
personal-cipher-preferences AES AES256 AES192 CAST5
personal-digest-preferences SHA256 SHA512 SHA384 SHA224
ignore-time-conflict 
allow-freeform-uid

gpg-agent.conf:

default-cache-ttl 300
max-cache-ttl 1200
pinentry-program /usr/bin/pinentry-gnome3

[nonnymoose]

Well, I found the culprit. It only doesn't work when firefox causes the native extension to call gpg and the pinentry program is set to pinentry-gnome3.

[maximbaz]

Does the native host connector do anything different with Chromium vs. Firefox?

No it's exactly the same code 🙂

Well, I found the culprit. It only doesn't work when firefox causes the native extension to call gpg and the pinentry program is set to pinentry-gnome3.

Nice job! Although I've just tried, and I don't reproduce the issue if I switch to pinentry-gnome3 (I'm also on Arch using latest Firefox). So I still think it's something related to your config...

Here are my configs btw: https://github.com/maximbaz/dotfiles/tree/master/.gnupg

[nonnymoose]

uhh... Wow, our setups are really similar...
Are you using Gnome as your desktop environment?
Judging by the fact that you're using dmenu I would guess that you're using i3. ;)

[maximbaz]

Correct, I use lightdm + i3wm :)

[maximbaz]

I knew this issue was familiar to me! This is not the first time people are having issues with Firefox, and it seems pinentry has always been the culprit: browserpass/browserpass-legacy#281, browserpass/browserpass-legacy#266, browserpass/browserpass-legacy#303

[nonnymoose]

Oh no...
So, this issue only happens

1. If you're using Firefox,
2. If you're using pinentry-gnome3, and
3. If you're using the GNOME desktop environment

(I tested it on i3 and it worked)

[maximbaz]

Nice findings!! I hate to just tell people to switch to another pinentry, but I'm really not sure where to report this issue if we want this to get fixed... To Firefox? To GNOME? 🤔

[nonnymoose]

I can't tell yet...
Here's what I've found so far through testing:

• There's no significant difference in the environment variables of gpg when called from firefox vs. when called by chrome
• If firefox is in focus when pass is run from the terminal, the pinentry dialogue appears (so that means that it's not some sort of obscure window conflict issue between firefox and pinentry-gnome3)
• There's no significant difference in the environment variables of pinentry-gnome3 when called from firefox vs chrome

Edit: I did an awful job of that 🤷‍♂️

[nonnymoose]

So, I found the problem. Turns out it was an obscure windowing conflict. Firefox steals focus from all other programs (you can't even use the GNOME 3 hot corner) when you have an extension dialogue box open. If you steal focus from pinentry-gnome3, it interprets it as a cancellation. Therefore, a GNOME pinentry popup cannot display while you have an extension dialogue box open. Looks like it is a Firefox bug after all.

[nonnymoose]

I submitted a bug on the Firefox bugzilla: https://bugzilla.mozilla.org/show_bug.cgi?id=1571259.