1303414 - increase preloaded information lifetimes

Status: NEW

(Core :: Security: PSM, defect, P3)

Description

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

We need to increase the lifetime of preloaded security information (particularly pinning, but possibly also HSTS).

Speaking mostly of pinning, the rationale was to prevent situations where a user has an old version of the browser and a site has (since the release of that version) rolled over its keys and/or CA, leading to a broken site. The current setup assumes 6 week release cycles and results in at best 2 weeks of leeway before the preloaded pins expire. Cycles can be longer than 6 weeks now (up to 8, I understand), and in any case 2 weeks of leeway isn't enough.

Comment 1

[:Cykesiopka]

Do we still intend to do this?

Bug 1307530 ensures that the HPKP pinning expiration for Firefox 50 is after the release of Firefox 51,
but it looks like we haven't done the same for 51 and 52.

https://hg.mozilla.org/releases/mozilla-beta/file/95d20a617288dde9faff91e847d414bb3403c157/security/manager/ssl/StaticHPKPins.h#l1167:
> static const PRTime kPreloadPKPinsExpirationTime = INT64_C(1487512954010000);
= 2017-02-19

If I'm reading https://wiki.mozilla.org/RapidRelease/Calendar correctly, Firefox 52 will be released on 2017-03-07.

Comment 2

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Thanks for reminding me. We probably still need to do something like this, but I keep having philosophical arguments with myself about if we can just change the lifetime without changing the max-age requirement on the header. In the meantime, JC is taking care of this particular instance in bug 1330446.

Comment 3

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

For posterity, as I noted in bug 1364240 comment 3:

> (FWIW, I'm not sure bug 1303414 is quite the right approach. I think we need
> to add a step somewhere in the release process where we go "ok, how long are
> we expecting this to be live?" and set the expiration dates of the pinning
> and strict-transport-security preload lists appropriately.)

Comment 4

[Emma Humphries ☕️🎸🧞‍♀️✨ (she/they) [:emceeaich] (Pacific Time) use needinfo]

This is an assigned P1 bug without activity in two weeks. 

If you intend to continue working on this bug for the current release/iteration/sprint, remove the 'stale-bug' keyword.

Otherwise we'll reset the priority of the bug back to '--' on Monday, August 28th.