Closed Bug 736573 Opened 14 years ago Closed 14 years ago

Encrypt in-app payment secrets with HSM

Categories

(addons.mozilla.org Graveyard :: Developer Pages, defect, P1)

Product:
addons.mozilla.org Graveyard
Component:
Developer Pages
Platform:
x86
macOS
Type:
defect

Tracking

(Not tracked)

Status:
RESOLVED WONTFIX

People

(Reporter: kumar, Unassigned)

References

Details

For an app to talk securely to the marketplace it needs to encrypt all requests with its secret (provided on sign-up in bug 703093) Instead of storing the secrets directly in the database we can store an encrypted secret in the database using an HSM key. This will come in two parts: - when a secret is generated on the management pages, encrypt/decrypt - when an app makes a payment request, decrypt its secret to verify the request
Blocks: 698116
Depends on: 736577
Priority: -- → P1
As part of this development, existing secrets should be disabled. That is, the app develops will need to regenerate them.
we are currently discussing whether or not it's ok to encrypt / decrypt with a key on disk rather than using the HSM.
Blocks: 742751
given the threat model around in-app payment secrets we decided that using the HSM is not necessary. Encrypt/decrypt moved to bug 742751
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → WONTFIX
Product: addons.mozilla.org → addons.mozilla.org Graveyard
You need to log in before you can comment on or make changes to this bug.