203308 - Adding a certificate authority do not need master password

Status: VERIFIED WONTFIX

(Core Graveyard :: Security: UI, enhancement, P3)

Description

[boris marechal]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; fr-FR; rv:1.3) Gecko/20030312
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr-FR; rv:1.3) Gecko/20030312

When I add a CA Certificate in mozilla, i do not need enter my master password,
so the CA list is not crypt ?



Reproducible: Always

Steps to Reproduce:
1.add a CA certificate
2.
3.

Actual Results:  
In my idea it's a potention security issue if another people could add to MY
profile HIS CA in order to push me to trust his certificat (that should be for
example the same name of a public server).

Expected Results:  
Crypt CA list with master password like own certificates

Comment 1

[Stephane Saux]

We don't consider this a security hole. If somebody has access to your machine
to add a CA cert via the ui, they also can change any dll on your machine to
send themselves your key pwd.

You have to manually trust the cert. Hence a hacker would have to have physical
access to the machine.

Comment 2

[John Unruh]

Verified.