1450865 - Sign snippet content and verify in the browser prior to loading

Status: NEW

(Firefox :: Messaging System, enhancement, P3)

Description

[Paul Theriault [:pauljt] (no longer reading bugmail)]

This is a follow-up from https://bugzilla.mozilla.org/show_bug.cgi?id=1430980#c6

I have a vague memory of discussing snippet signing in the past, but I can't recall the outcome. Given the current re-architecture work, now might be a good time to consider signing snippet content, in the same way that we sign SHIELD recipes.

Comment 1

[Paul Theriault [:pauljt] (no longer reading bugmail)]

Julien, have you ever looked at snippets, and do you know if signing has been discussed? If not, can you provide some insight into what work would be need on the signing side?

Comment 2

[Frederik Braun [:freddy]]

See also bug 1437671, which is about signing of top sites.

Comment 3

[Julien Vehent]

As Freddy mentioned, we discussed this with Nan in the context of Tippytop and activity stream in general. This will require changes to both the code in Firefox (to verify signatures) and to the backend Snippets service to request signatures from Autograph.