	Product Security Feature Roadmap
	Owner: Lucas Adamski	Updated: 2012-11-13
	Security at Mozilla can be thought of a set of principles that are reflected in the products we ship, but also in the impact Mozilla has on the entire web. As such our security roadmap should reflect the real security improvements we need to make to our products to reflect the evolving security landscape, but also the ambitious impact we'd like to have on all web users.

	THIS PAGE IS A WORKING DRAFT
	The page may be difficult to navigate, and some information on its subject might be incomplete and/or evolving rapidly. If you have any questions or ideas, please add them as a new topic on the discussion page.

Vision

Security at Mozilla can be thought of a set of principles that are reflected in the products we ship, but also in the impact Mozilla has on the entire web.

Themes and Goals

Web users are under constant attack from a wide variety of opponents, many of whom are merely opportunistic, but also by a minority of very clever and determined attackers. To protect users, we need to improve our current products to keep pace with these evolving threats, but we are ultimately limited in what we can do unilaterally within our products. We must also drive innovative solutions that require the participation of other vital players in the web ecosystem, including standards bodies, internet technology vendors, web developers, web admins and web frameworks.

As such, security engineering at Mozilla has two primary themes:

Product Hardening: Protect our users directly from an ever-increasing volume & sophistication of online attacks, by directly improving the products and services we deliver
Security Leadership: Drive innovative security solutions to enable the wider web ecosystem of web developers, web admins and users to adapt to evolving web technologies and their corresponding security threats.

Here the concrete goals are segmented into themes. Some goals may potentially fit into multiple themes, but are only identified here under the most relevant one.

Survey taken in early 2011 to identify and prioritize potential features for our security roadmap. The results of this survey are available as a Google doc or as PDF: File:Security roadmap survey.pdf.

NOTE: these goals are tentative and more may be added or some may be dropped.

Roadmap

Items with Feature Pages

{{#ask: Feature stage::!Complete Feature roadmap::Security OR Feature secondary roadmap::Security | ?# | ?Feature name# | ?Feature priority# | ?Feature engineering team# | ?Feature stage# | ?Feature feature manager# | ?Feature theme# | mainlabel=- | sort=Feature priority,Feature stage | format=template | limit=500 | template=FeatureListTable }}

Outcomes:

There are some major outcomes that can be realized by completion of multiple features. These features already show up on the master list above, but this categorizes them into desired outcomes.

HTTPS can be used as default

Right now, when users navigate to a web site without specifying the protocol or scheme, Firefox assumes "http" as the scheme. For optimal protection from eavesdropping and for encryption of cookies and other HTTP request data in transit, we should be able to attempt HTTPS and fall back to HTTP only when absolutely necessary.

This outcome can be realized when Firefox can be changed to default to the HTTPS scheme instead of HTTP.

{{#ask: Feature name::HSTS Preload List OR Feature name::HTTPS (SSL) Google Search OR Feature name::OCSP Stapling | ?# | ?Feature name# | ?Feature priority# | ?Feature stage# | ?Feature version# | ?Feature product manager# | ?Feature feature manager# | mainlabel=- | sort=Feature priority, Feature stage | format=template | limit=500 | template=FeatureListTable }}

Ideas Not Yet Awesome Enough

Apparently these ideas are not yet great enough to merit feature pages. If you disagree, you can create a new feature page for it! Just make sure to put "Security" in the primary or secondary roadmap field.

Item	Owner
First-run warning for new plugins
Plugin sandboxing
Malloc should be infallible
TLS 1.2 support
Eviltraps meta-bug (prevents users from leaving a page)
Notify user of malware in their crash signatures
Expose HSTS and other security browser state to plugins (NPAPI)
Ignore autocomplete="off" for password fields
Content Security Policy revisions	Brandon Sterne
Clickjacking mitigations
X-Content-Type-Options
toStaticHTML
Block DLLs without ASLR
Force ASLR or similar mitigations (EMET)

Completed Features

{{#ask: Feature stage::Complete Feature roadmap::Security OR Feature secondary roadmap::Security Feature stage::Complete | ?# | ?Feature name# | ?Feature priority# | ?Feature engineering team# | ?Feature stage# | ?Feature product manager# | ?Feature theme# | mainlabel=- | sort=Feature priority,Feature stage | format=template | limit=500 | template=FeatureListTable }}

Related Info

Links to implementation plan and progress:

Inputs into the security roadmap:

sec-want bugs that are both important and complex

SecurityEngineering/Roadmap

Contents