Comment by Someone1234 | Hacker News Reader

Comment by Someone1234 | Hacker News Reader

Parent Full thread

Looks like it is going to:

Computer\HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts

For ".html", ".htm" and:

Computer\HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations

For "https", "http" then:

- Nuke the UserChoice key because Microsoft put special permissions on it.

- Re-create the UserChoice key setting the ProgId to Firefox and then calculating the hash.

- The hash is calculated using, in part, a hard-coded Windows internal GUID see FormatUserChoiceString here:

https://hg.mozilla.org/releases/mozilla-release/diff/7e775ce...

The whole thing looks super easy for Microsoft to break in a future Windows release unfortunately.

Interestingly, the first two registry steps are actually the same as the previous windows. Having it behind a hash seems way too user hostile though.

Sounds like what SetUserFTA does: https://kolbi.cz/blog/2017/10/25/setuserfta-userchoice-hash-...

> The whole thing looks super easy for Microsoft to break in a future Windows release unfortunately.

There are more aggressive techniques available that cannot be turned off very easily. TrustedInstaller is the first one that comes to mind. If you cant politely ask the registry, you can always nuke edge from orbit.

I hope Firefox keeps pushing down this route. Make your installation process as inflammatory as possible. I would encourage a "Remove all existing web browsers" checkbox in the final pane of the installation process - Default selected, of course. Give them a proper taste of their own medicine.

> "Remove all existing web browsers" checkbox

Users having multiple browsers installed that they switch between is a good thing that puts more pressure on browsers to improve, and I would hate to see Firefox or any other vendor push the dynamic farther away from that.

Looks like the hard-coded Windows internal GUID is found in C:\Windows\SysWOW64\Shell32.dll

If you search for the string: "User Choice set via Windows User Experience", you'll find the GUID used to calculate the hash.

Reply on news.ycombinator.com