Closed Bug 1548920 Opened 5 years ago Closed 5 years ago

Security Review of Password Generation

Categories

(Firefox Graveyard :: Security: Review Requests, task, P1)

Product:
Firefox Graveyard
Component:
Security: Review Requests
Type:
task

Tracking

(firefox70+ fixed)

Status:
RESOLVED FIXED
Tracking Flags:
Tracking Status
firefox70 + fixed

People

(Reporter: MattN, Assigned: dveditz)

References

(Blocks 1 open bug,
URL
)

Details

(Whiteboard: [passwords:generation] [skyline][sci-exclude])

There isn't anything to review yet as we haven't started implementation but eventually I would like a review of:

  • The password generation algorithm and implementation chosen to ensure there is enough entropy and no unnecessary bias in the generated passwords.
  • Should we generate passwords in insecure forms?
  • Should we cache by principal's origin across tabs?

I'll update this comment if there are more things to review and I'll email pi-request@ when the review can begin.

Thanks Matt - secreview has moved though. Send your email to secreview@mozilla.com (I'll give them a heads up).

Flags: qe-verify-
QA Whiteboard: [skyline], feature
status-firefox70: --- → affected
tracking-firefox70: --- → +
QA Whiteboard: [skyline], feature
Whiteboard: [skyline]
Whiteboard: [skyline] → [passwords:generation] [skyline]
Assignee: nobody → dveditz
Status: NEW → ASSIGNED
Priority: -- → P1
Whiteboard: [passwords:generation] [skyline] → [passwords:generation] [skyline][sci-exclude]
Status: ASSIGNED → RESOLVED
Closed: 5 years ago
Resolution: --- → FIXED
Product: Firefox → Firefox Graveyard
You need to log in before you can comment on or make changes to this bug.