[tor-bugs] #3555 [Tor bundles/installation]: TBB: hardcode SSL cert check to prevent MITM

[Tor Bug Tracker & Wiki]

#3555: TBB: hardcode SSL cert check to prevent MITM
----------------------------------------+-----------------------------------
 Reporter:  tagnaq                      |          Owner:  mikeperry                    
     Type:  defect                      |         Status:  assigned                     
 Priority:  blocker                     |      Milestone:  TorBrowserBundle 2.2.x-stable
Component:  Tor bundles/installation    |        Version:                               
 Keywords:  MikePerryIteration20110911  |         Parent:                               
   Points:  1                           |   Actualpoints:                               
----------------------------------------+-----------------------------------
Changes (by mikeperry):

 * cc: rransom (added)


Comment:

 I'm reading the code closer, and it appears that onLoad is only "pinning"
 the common name, the issuer string, and the builtin property. This will at
 least pin them to a specific builtin CA (I think), but it can't pin a
 specific cert.

 It also doesn't apply to addon updates: only Firefox updates. Addon
 updates are handled elsewhere.

 Sorry, rransom, but I think we're going to have to wait for proper pinning
 support in Firefox to be able to do this for our addon updates. :(

 Either that, or we begin signing the Torbutton XPI with that horrid McCoy
 tool?

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/3555#comment:11>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online