Changes to KeeFox in 2017

By the end of this year KeeFox will have to change significantly so this post is an overview of what will change, how, when and why. Many of the details are still uncertain and will depend partially on how much spare time can be found to implement the changes and how many people can contribute to help this process. I'll post updates throughout the year as changes are made so you know what to expect when the bulk of the changes arrive at the end of the year in the form of KeeFox version 2.

KeeFox 2

KeeFox will continue to connect Firefox to KeePass and assist with filling in the correct passwords into the correct form fields so that you can log in easily. Beyond that, there is a lot of uncertainty about exactly what KeeFox will look and behave like.

These changes are being made because Mozilla - the developers of Firefox - have decided that they no longer wish to allow the level of extensibility that KeeFox depends upon in order to modify the web browser. The benefits and drawbacks of this decision are complex and you'll find reference to them in many places over the past couple of years but regardless of how one feels about it, if a Firefox add-on wants to continue to exist into 2018, it must be re-written to use the new more-limited add-on platform called WebExtensions.

You'll definitely notice the changes and we'll try to ensure they are improvements wherever possible but the reduced control that we'll have over how the add-on behaves will present challenges to all add-ons like KeeFox which aim to simplify the use of external tools (KeePass in our case).

Application support

KeeFox has always been an add-on for Firefox first and foremost but it can currently offer at least some functionality to other browsers similar to Firefox and to the Thunderbird email client. KeeFox 2.0 may not be able to work in those other applications but for the first time it will be able to run in the Google Chrome browser, as well as (probably) Microsoft Edge and Opera.

It's too early to say what the future for Thunderbird support is but it's very likely that either KeeFox 1.7, KeeFox 2.0 or a derived (forked) version of the KeeFox 1.x add-on can continue to offer easy password filling in that application.

 

Roadmap

KeeFox 1.7

(due in roughly May 2017)

This will be the last release of KeeFox in it's current form. It will exist primarily to ensure the later upgrade to KeeFox 2.0 goes as smoothly as possible.

 

KeeFox 1.8?

Serious security problems found in the current KeeFox 1.x add-on will still be fixed at least until version 2.0 is released and possibly beyond. Support for any version lower than 2.0 beyond the end of 2017 is uncertain but would likely be dependent on other KeeFox users offering time to help and maintain the old 1.x version.

 

KeeFox 2.0

(due in roughly November 2017, with frequent alpha and beta releases in the months leading up to this date)

I've created a list of Milestones on the new GitHub project to record more detail and will add more information as the path to a stable KeeFox version 2 becomes clearer.

Contributing

I'll update the Contributing page on the wiki soon with more information about how you can help us to ensure that we can make the most of this enforced change. Right now, you can look at the new GitHub repository to see the current progress towards version 2.0. It's not especially functional yet, has known security flaws, should never be used with real password databases or any non-temporary browser user profile and has not even been run inside Firefox yet (the limited testing so far has used Google Chrome). All that said, I hope that the existence of this early progress snapshot can help other developers to assist with the large amount of work that remains.

Note that along with the creation of this new GitHub repository, the existing KeeFox (1.x) repository will also be migrated to the new GitHub organisation I've set up to keep all related projects together. I expect the old addresses to keep working via redirection but if something goes wrong please let me know.

Feedback

I know this is a large and complex topic and some of you will have questions and comments. I'd like to keep them all together so I've created an issue on the new GitHub repo to offer a little more detail and facilitate discussion so please take a look and get involved!


Article categories: [development keefox KeePass KeePassRPC linux mac mono news]
Published on: 26 March 2017