1538644 - Consider using a separate domain for MitM priming

Status: NEW

(Firefox :: Security, enhancement, P3)

Description

[Johann Hofmann [:johannh]]

In bug 1529643 we enabled automatically detecting man in the middle software using a priming network request to https://mitmdetection.services.mozilla.com/. According to reports from Philipp (SUMO), some AV vendors actually exempt Mozilla domains from their interception to allow for updates etc.

We should figure out if this is really an issue and if so, we should consider adding a new domain specifically for MitM detection.

Comment 1

[Johann Hofmann [:johannh]]

Hey :wezhou, as mentioned via email we'd need support from Ops here, and you mentioned that you could handle prioritization. Is there anything else you need?

Thanks!

Comment 2

[:wezhou]

Is there any data to show how many users are having issues with https://mitmdetection.services.mozilla.com/ being the endpoint?

Comment 3

[Johann Hofmann [:johannh]]

Not really and it's hard to measure, since that URL is what's used to find issues in the first place :)

This is mostly based on our subjective feeling based on SUMO reports.