1591269 - (osclientcerts) [meta] osclientcerts tracking bug

Status: NEW

(Core :: Security: PSM, task, P3)

Description

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

This bug tracks the implementation of the osclientcerts PKCS#11 module that will enable Firefox to use client certificates from the OS.

Comment 1

[Mike Hommey [:glandium]]

Are there plans for Unix?

Comment 2

[J.C. Jones [:jcj] (he/him)]

To my knowledge, there's no stable mechanism to store certificates using a TPM/TrustZone on Linux or the BSDs. Gnome-Keyring can probably be hacked on to do it via trousers [0], but arguably since that produces a PKCS#11 module, it could just be plugged straight into Firefox and "be" this implementation instead of the osclientcerts rust library... but trousers is not actively maintained, and I'm not sure of anything else state-of-the-art in the *nix world for this.

Most distributions install client certs directly into system NSS, which is then used by Firefox, which makes it de facto the OS Client Cert store already.

[0] https://github.com/srajiv/trousers

Comment 3

[Jay Libove]

I had opened https://bugzilla.mozilla.org/show_bug.cgi?id=1624317 which is now closed WONTFIX due to the presence of this osclientcerts plan.

I hope that the foundation does decide to address this soon. It's been outstanding for a long time, and I worry that it provides a real attack chain opportunity (infect a "known good" page where users SHOULD unlock their stored certificates, then redirect them somewhere else where they should NOT, but as the one-time-per-session unlock has already been performed, their certificates can then be [ab]used without a password prompt).

I see that it is currently dependent on a bug relating to the level of debugging available from the current interface to Windows OS client certificate storage.
I wonder that waiting on more-perfect diagnostic information from that module, while retaining the current too-low granularity of control over access to security-critical assets (certificate private key use) maybe isn't the right balance?

thank you.

Comment 5

[Tom25519]

In about:config, security.osclientcerts.autoload=true by default (at least Firefox 97). But some CA is incredibility, such as CNNIC ROOT, which had been untrust by most browsers for a long time, but it still in Windows Certmanagement, so if any goverment malware install it, and any website use certificate issue by CNNIC, it will store into Firefox certificate store, gov could use it to MITM, it's very dangerous!

Comment 6

[Tom25519]

So I hope security.osclientcerts.autoload = false by default.

Comment 7

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

osclientcerts doesn't affect the trust settings of root certificates.

Comment 8

[Maria Hall]

Attachment: same problem

Thanks from raymonqicur1989.