[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #20146 [Applications/Tor Browser]: Tor browser certificate pinning bypass for addons.mozilla.org and other pinned sites
#20146: Tor browser certificate pinning bypass for addons.mozilla.org and other
pinned sites
--------------------------------------+--------------------------
Reporter: mancha | Owner: tbb-team
Type: defect | Status: new
Priority: Immediate | Milestone:
Component: Applications/Tor Browser | Version:
Severity: Critical | Resolution:
Keywords: | Actual Points:
Parent ID: | Points:
Reviewer: | Sponsor:
--------------------------------------+--------------------------
Comment (by arma):
Sebastian points out, I think correctly, that right now there is an https-
everywhere update key somewhere in the world that is trusted by Tor
Browser users (i.e. it can give them a bad update if it wants). GeKo
points out that this issue is #10394.
Separately, there is a site called addons.m.o which is trusted by Tor
Browser users, because it can give them a bad noscript (either by having
users accidentally go to a fake addons.m.o, or by having users go to the
real one and it gives them a bad update).
My 'option 1' above leaves both of these issues in place.
My 'option 2' resolves both of them, assuming we do it for both noscript
and https-everywhere.
Whereas my 'option 3' replaces the addons.m.o issue with a new "there's a
noscript update key somewhere in the world that is trusted" issue.
This logic makes me like 'option 2' even more.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/20146#comment:3>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs