[tbb-commits] [tor-browser] 03/03: fixup! Firefox preference overrides.

[gitolite role]

This is an automated email from the git hooks/post-receive script.

richard pushed a commit to branch tor-browser-91.12.0esr-12.0-1
in repository tor-browser.

commit deafecfad5c47cce61b725b68eb0ac2d7cef6822
Author: Richard Pospesel <richard at torproject.org>
AuthorDate: Thu Aug 4 09:00:02 2022 +0000

    fixup! Firefox preference overrides.
    
    Bug 27719: Treat unsafe renegotiation as broken
---
 browser/app/profile/001-base-profile.js | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/browser/app/profile/001-base-profile.js b/browser/app/profile/001-base-profile.js
index d3cb37e4d383e..1ec066c0a15c2 100644
--- a/browser/app/profile/001-base-profile.js
+++ b/browser/app/profile/001-base-profile.js
@@ -64,6 +64,18 @@ pref("media.memory_cache_max_size", 16384);
 pref("dom.security.https_only_mode", true);
 pref("dom.security.https_only_mode.upgrade_onion", false);
 
+// Require Safe Negotiation ( https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/27719 )
+// Blocks connections to servers that don't support RFC 5746 [2] as they're potentially vulnerable to a
+// MiTM attack [3]. A server without RFC 5746 can be safe from the attack if it disables renegotiations
+// but the problem is that the browser can't know that. Setting this pref to true is the only way for the
+// browser to ensure there will be no unsafe renegotiations on the channel between the browser and the server
+// [STATS] SSL Labs (July 2021) reports over 99% of top sites have secure renegotiation [4]
+// [1] https://wiki.mozilla.org/Security:Renegotiation
+// [2] https://datatracker.ietf.org/doc/html/rfc5746
+// [3] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3555
+// [4] https://www.ssllabs.com/ssl-pulse/
+pref("security.ssl.require_safe_negotiation", true);
+
 // Misc privacy: Remote
 pref("browser.send_pings", false);
 pref("geo.enabled", false);

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.