Why HTTPS Everywhere isn't on addons.mozilla.org

Re:Why HTTPS Everywhere isn't on addons.mozilla.org by bigiain on Tuesday November 25, 2014 @07:46PM (#8660674)

Unless, as the article points out, the attacker has your private SSL key (perhaps leaked via Heartbleed).

Without cert pinning here's also the problem of the attacker convincing some browser-trusted CA to issue an SSL cert for addons.mozilla.org, then MITMing you with that.

(And with 600+ trusted roots, many of which are owned by various governments, against state level attackers an ssl connection's claim of authenticity has to be considered very close to worthless...)

[ Parent | on HN ]

Re:Why HTTPS Everywhere isn't on addons.mozilla.org by bzbarsky on Wednesday November 26, 2014 @11:03AM (#8662912)

> Without cert pinning

In the case of Firefox connecting to addons.mozilla.org, there is cert pinning.

[ Parent | on HN ]

Re:Why HTTPS Everywhere isn't on addons.mozilla.org by bigiain on Wednesday November 26, 2014 @05:38PM (#8664986)

I didn't know that, thanks.

(In retrospect, it's such an obvious thing for them to do - I don't know why I didn't assume it was likely enough to be implemented and check before I posted that...)

[ Parent | on HN ]

Re:Why HTTPS Everywhere isn't on addons.mozilla.org by bzbarsky on Thursday November 27, 2014 @01:32AM (#8666234)

To be fair, I _think_ the pinning was only added in Firefox 32, back in September. So it's a pretty recent development.

[ Parent | on HN ]