Navigation Menu

Skip to content
This repository has been archived by the owner on Nov 1, 2022. It is now read-only.

Fretboard: Certificate pinning #433

Closed
pocmo opened this issue Jul 17, 2018 · 1 comment
Closed

Fretboard: Certificate pinning #433

pocmo opened this issue Jul 17, 2018 · 1 comment
Labels
🌟 feature New functionality and improvements

Comments

@pocmo
Copy link
Contributor

pocmo commented Jul 17, 2018 •
edited by data-sync-user

From mozilla-mobile/fretboard#15

In addition to verifying the signature of a collection (#13) we should use certificate pinning:

https://www.owasp.org/index.php/Certificate_and_Public_Key_Pinning#What_Is_Pinning.3F
Fennec bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1329721

┆Issue is synchronized with this Jira Task
@pocmo pocmo added 🌟 feature New functionality and improvements <fretboard> labels Jul 17, 2018
@pocmo pocmo mentioned this issue Jul 17, 2018
Closed
@pocmo pocmo changed the title Certificate pinning Fretboard: Certificate pinning Jul 17, 2018
fercarcedo added a commit to fercarcedo/android-components that referenced this issue Jul 18, 2018
@fercarcedo
Issue mozilla-mobile#433: Fretboard: Certificate pinning
c4b3180 
Closes mozilla-mobile#433: Fretboard: Certificate pinning
@fercarcedo fercarcedo mentioned this issue Jul 18, 2018
Closed
fercarcedo added a commit to fercarcedo/android-components that referenced this issue Jul 18, 2018
@fercarcedo
Issue mozilla-mobile#433: Fretboard: Certificate pinning
0a99d36 
Closes mozilla-mobile#433: Fretboard: Certificate pinning
fercarcedo added a commit to fercarcedo/android-components that referenced this issue Jul 26, 2018
@fercarcedo
Issue mozilla-mobile#433: Fretboard: Certificate pinning
f8fc311 
Closes mozilla-mobile#433: Fretboard: Certificate pinning
fercarcedo added a commit to fercarcedo/android-components that referenced this issue Jul 26, 2018
@fercarcedo
Issue mozilla-mobile#433: Fretboard: Certificate pinning
f11af34 
Closes mozilla-mobile#433: Fretboard: Certificate pinning
fercarcedo added a commit to fercarcedo/android-components that referenced this issue Aug 7, 2018
@fercarcedo
Issue mozilla-mobile#433: Fretboard: Certificate pinning
5ea3f5a 
Closes mozilla-mobile#433: Fretboard: Certificate pinning
fercarcedo added a commit to fercarcedo/android-components that referenced this issue Aug 7, 2018
@fercarcedo
Issue mozilla-mobile#433: Fretboard: Certificate pinning
af4b1af 
Closes mozilla-mobile#433: Fretboard: Certificate pinning
fercarcedo added a commit to fercarcedo/android-components that referenced this issue Aug 8, 2018
@fercarcedo
Issue mozilla-mobile#433: Fretboard: Certificate pinning
f7bf463 
Closes mozilla-mobile#433: Fretboard: Certificate pinning
fercarcedo added a commit to fercarcedo/android-components that referenced this issue Aug 8, 2018
@fercarcedo
Issue mozilla-mobile#433: Fretboard: Certificate pinning
cdf123a 
Closes mozilla-mobile#433: Fretboard: Certificate pinning
@pocmo
Copy link
Contributor Author

pocmo commented Aug 21, 2018

WONTFIX: Given the feedback of the security team I think we should move forward without certificate pinning. Signature validation is a stronger signal and does not have all the problems that come with cert pinning.

@pocmo pocmo closed this as completed Aug 21, 2018
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
🌟 feature New functionality and improvements
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@pocmo