Confirmed users
299
edits
SecurityEngineering/Public Key Pinning: Difference between revisions
SecurityEngineering/Public Key Pinning (view source)
Revision as of 20:11, 23 May 2024
, 23 May 2024→Implementation status: remove no-longer-pinned sites
No edit summary |
(→Implementation status: remove no-longer-pinned sites) |
||
| (9 intermediate revisions by 2 users not shown) | |||
| Line 6: | Line 6: | ||
== Implementation status == | == Implementation status == | ||
Firefox 32 and later has the ability to enforce built-in pinsets, or mappings of public key information to domains ({{bug|744204}}). | Firefox 32 on desktop and later has the ability to enforce built-in pinsets, or mappings of public key information to domains ({{bug|744204}}). | ||
We | Pinning is supported in Firefox 34 and later on Android. | ||
# Pin all of the sites that Chrome already does (Google | |||
# Pin our own sites after auditing them and cleaning them up | We currently: | ||
# Pin all of the sites that Chrome already does (mainly Google sites) by importing chromium's pinset. | |||
# Pin our own sites after auditing them and cleaning them up. | |||
# Pin other popular sites like Facebook that are in good shape already (with their cooperation, of course) | # Pin other popular sites like Facebook that are in good shape already (with their cooperation, of course) | ||
=== | === Currently-pinned Sites === | ||
* AMO: *.addons.mozilla.org, *.addons.mozilla.net | * AMO: *.addons.mozilla.org, *.addons.mozilla.net | ||
* Firefox accounts: *.accounts.firefox.com | |||
* Mozilla CDN: *.cdn.mozilla.{org,net}, *.media.mozilla.com | * Mozilla CDN: *.cdn.mozilla.{org,net}, *.media.mozilla.com | ||
* Google: too many to list (see everything from https://src.chromium.org/viewvc/chrome/trunk/src/net/http/transport_security_state_static.json with the "google" pinset) | * Google: too many to list (see everything from https://src.chromium.org/viewvc/chrome/trunk/src/net/http/transport_security_state_static.json with the "google" pinset) | ||
* TOR | * TOR | ||
Tracking bug for pinning all the things: {{bug|1004350}} | Tracking bug for pinning all the things: {{bug|1004350}} | ||
| Line 34: | Line 27: | ||
Starting with FF 32, it's on by default, so you don't have to do anything. The pinning level is enforced by a pref, security.cert_pinning.enforcement_level | Starting with FF 32, it's on by default, so you don't have to do anything. The pinning level is enforced by a pref, security.cert_pinning.enforcement_level | ||
0. Pinning disabled | * 0. Pinning disabled | ||
1. Allow User MITM (pinning not enforced if the trust anchor is a user inserted CA, default) | * 1. Allow User MITM (pinning not enforced if the trust anchor is a user inserted CA, default) | ||
2. Strict. Pinning is always enforced. | * 2. Strict. Pinning is always enforced. | ||
3. Enforce test mode. | * 3. Enforce test mode. | ||
== More information == | == More information == | ||
[[SecurityEngineering/Public_Key_Pinning/SiteOperators]] | * [[SecurityEngineering/Public_Key_Pinning/SiteOperators]] | ||
[[SecurityEngineering/Public_Key_Pinning/ReleaseEngineering]] | * [[SecurityEngineering/Public_Key_Pinning/ReleaseEngineering]] | ||
* [[SecurityEngineering/Public_Key_Pinning/Implementation_Details]] | |||
== Public Key Pinning Extension for HTTP == | == Public Key Pinning Extension for HTTP == | ||