Confirmed users
299
edits
SecurityEngineering/Public Key Pinning: Difference between revisions
SecurityEngineering/Public Key Pinning (view source)
Revision as of 20:11, 23 May 2024
, 23 May 2024→Implementation status: remove no-longer-pinned sites
(remove dead link to dashboard) |
(→Implementation status: remove no-longer-pinned sites) |
||
| Line 10: | Line 10: | ||
Pinning is supported in Firefox 34 and later on Android. | Pinning is supported in Firefox 34 and later on Android. | ||
We | We currently: | ||
# Pin all of the sites that Chrome already does (Google | # Pin all of the sites that Chrome already does (mainly Google sites) by importing chromium's pinset. | ||
# Pin our own sites after auditing them and cleaning them up. | # Pin our own sites after auditing them and cleaning them up. | ||
# Pin other popular sites like Facebook that are in good shape already (with their cooperation, of course) | # Pin other popular sites like Facebook that are in good shape already (with their cooperation, of course) | ||
=== | === Currently-pinned Sites === | ||
* AMO: *.addons.mozilla.org, *.addons.mozilla.net | * AMO: *.addons.mozilla.org, *.addons.mozilla.net | ||
* Firefox accounts: *.accounts.firefox.com | |||
* Mozilla CDN: *.cdn.mozilla.{org,net}, *.media.mozilla.com | * Mozilla CDN: *.cdn.mozilla.{org,net}, *.media.mozilla.com | ||
* Google: too many to list (see everything from https://src.chromium.org/viewvc/chrome/trunk/src/net/http/transport_security_state_static.json with the "google" pinset) | * Google: too many to list (see everything from https://src.chromium.org/viewvc/chrome/trunk/src/net/http/transport_security_state_static.json with the "google" pinset) | ||
* TOR | * TOR | ||
Tracking bug for pinning all the things: {{bug|1004350}} | Tracking bug for pinning all the things: {{bug|1004350}} | ||