1004350 - Pin all the things

Status: NEW

(Core :: Security: PSM, defect, P3)

Description

[[:mmc] Monica Chew (no longer reading bugmail)]

The first iteration of CA pinning includes pinning only mozilla sites. It is possible to pin many more, this is the tracking bug for that.

Comment 1

[Sylvestre Ledru [:Sylvestre]]

added it for the beta 32 release notes:
"Public key pinning support enabled (learn more)"
learn more pointing to the wiki page
https://wiki.mozilla.org/SecurityEngineering/Public_Key_Pinning

I guess that also applies to Android, right?

Comment 2

[[:mmc] Monica Chew (no longer reading bugmail)]

(In reply to Sylvestre Ledru [:sylvestre] from comment #1)
> added it for the beta 32 release notes:
> "Public key pinning support enabled (learn more)"
> learn more pointing to the wiki page
> https://wiki.mozilla.org/SecurityEngineering/Public_Key_Pinning
> 
> I guess that also applies to Android, right?

Thanks for asking, it only applies to desktop so far. We wanted to wait to turn it on for Fennec just in case there are massive problems :P

https://bugzilla.mozilla.org/show_bug.cgi?id=1019255

Fennec bug:

Comment 3

[Lawrence Mandel [:lmandel] (use needinfo)]

Added to 34 mobile release notes.

Comment 4

[robert]

Where can we find the current list of pinned websites. Is the wiki documentation https://wiki.mozilla.org/SecurityEngineering/Public_Key_Pinning still up to date?