941079 - Security Review: [Program] FxA on FxOS (v1.4)

Status: RESOLVED FIXED

(mozilla.org Graveyard :: Security Assurance: FxOS Review, task)

Description

[toxborrow]

Initial Questions:

Project/Feature Name: [Program] FxA on FxOS (v1.4)
Tracking  ID:
Description:
The goal of this release is that on the device by signing into WheresMyFox or Marketplace, you're signed into both. This is really SSO on the device. 
Additional Information:
FxA Wiki: https://wiki.mozilla.org/Identity/FirefoxAccounts
FxA Roadmap: https://wiki.mozilla.org/Identity/Roadmap
Key Initiative: Firefox OS
Release Date: 2014-03-03
Project Status: development
Mozilla Data: Yes
Mozilla Related: FxA on FxOS, Where's My Fox, Marketplace
Separate Party: No

Security Review Questions:

Affects Products: 
Review Due Date: 2014-01-31
Review Invitees: Jed Parsons, Chris Karlof, Tauni Oxborrow
Extra Information:

Comment 1

[Paul Theriault [:pauljt] (no longer reading bugmail)]

Does the security review of FxA for FxOS need to be marked as confidential ? (I though this project was public, at least most information is already on https://wiki.mozilla.org/Identity/FirefoxAccounts). Or is this just confidential by default (Imnot familiar with the project kick-off process).

Comment 2

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

all bugs from kick off are MoCo flag by default, we should remove the flag if it's not needed

Comment 3

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

since there was a mail to everyone@moz I will assume this is public

Comment 4

[Caitlin Galimidi [:c8o]]

Hey there Paul - 
When you have a moment, is the sec review for FxA on FxOS scheduled?
Am I assuming this sec review covers FxA on Marketplace and in payments as well?

Caitlin

Comment 5

[Paul Theriault [:pauljt] (no longer reading bugmail)]

This review was FxA in 2.0. I don't believe cr looked at FxA in marketplace or payments so we should have a seperate review for that. The documentation is here: 

https://wiki.mozilla.org/Security/Reviews/B2G/FirefoxAccounts

I'll create a separate bug for FxA on Marketplace and in payments.