#3555: TBB: hardcode SSL cert check to prevent MITM
----------------------------------------+-----------------------------------
Reporter: tagnaq | Owner: mikeperry
Type: defect | Status: assigned
Priority: blocker | Milestone: TorBrowserBundle
2.2.x-stable
Component: Tor bundles/installation | Version:
Keywords: MikePerryIteration20110911 | Parent:
Points: 1 | Actualpoints:
----------------------------------------+-----------------------------------
Changes (by mikeperry):
* cc: rransom (added)
Comment:
I'm reading the code closer, and it appears that onLoad is only "pinning"
the common name, the issuer string, and the builtin property. This will at
least pin them to a specific builtin CA (I think), but it can't pin a
specific cert.
It also doesn't apply to addon updates: only Firefox updates. Addon
updates are handled elsewhere.
Sorry, rransom, but I think we're going to have to wait for proper pinning
support in Firefox to be able to do this for our addon updates. :(
Either that, or we begin signing the Torbutton XPI with that horrid McCoy
tool?
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/3555#comment:11>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
[email protected]
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs
