1012879 - only allow certificate overrides if the user can provide a matching out-of-band certificate fingerprint

Status: RESOLVED WONTFIX

(Core :: Security: PSM, defect)

Description

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Instead of allowing insecure certificate overrides through a series of clicks, we should protect users by ensuring they're seeing the expected certificate by having them provide a certificate fingerprint they received from a (hopefully secure) out-of-band source.

Comment 2

[Lorenzo Keller]

@Cykesiopka : thanks for finding the duplicate, despite the time I spent searching for it I couldn't find it myself.

I would like add to keeler's idea: Verifying certificates with a fingerprint can be seen as a simple and secure way to authenticate a remote server. I think it could even become a "normal" way to authenticate servers when CAs certificates cannot be used easily. 

The most important use case of this approach is that this would enable more widespread use of self-signed certificates in embedded applications: such as securing the connection to appliances, routers, etc. The manufacturer could print on the same label where it prints the MAC address the SSL certificate fingerprint.

Comment 3

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

This would really be nice, but I doubt we'll ever ship it in Firefox. Might work as an add-on, though.