SecurityEngineering/Newsletter: Difference between revisions

From MozillaWiki
Jump to navigation Jump to search
m (fix broken url)
(Replaced content with "This newsletter is no longer maintained. ---- '''Previous Editions''' * 2016 4th Quarter * SecurityEngineering/Newsletter/20...")
 
(5 intermediate revisions by 3 users not shown)
Line 1: Line 1:
 
This newsletter is no longer maintained.  
= Firefox Security Team Newsletter Q2 17 =
Firefox 55 is out the door, so there’s time now to put together our quarterly newsletter. In addition to the [https://developer.mozilla.org/en-US/Firefox/Releases/55#Security security changes] which hit release last week, there has been a number of important security improvements land over the last quarter:
* We’ve made significant improvement of our security sandbox, with file system restrictions shipping for Windows and macOS on beta (Firefox 56) and Linux on nightly (Firefox 57)
* Firefox 56 has a significant speedup for the most common cryptographic algorithm used in secure websites, [https://www.franziskuskiefer.de/web/improving-aes-gcm-performance-in-nss/ AES-GCM] (an official Mozilla blog post still to come).
* We have continued the Tor Uplift work and entered the second phase to implement [[Security/Fingerprinting|browser fingerprinting resistance]] starting from Firefox 55.
Read on for more highlights of the important work the Firefox security team is doing to keep our users safe online.
 
= Team Highlights =
 
== Security Engineering ==
 
=== Crypto Engineering ===
* Firefox 56 has a significant speedup for the most common cryptographic algorithm used in secure websites, [https://www.franziskuskiefer.de/web/improving-aes-gcm-performance-in-nss/ AES-GCM] (an official Mozilla blog post still to come).
* A regression from e10s where CORS error messages weren’t logged properly in the console is fixed in Firefox 56.
 
=== Privacy and Content Security ===
* We have continued the Tor Uplift work and entered the second phase to implement browser fingerprinting resistance starting from Firefox 55.
** Landed [[Security/Fingerprinting|18 bugs]] for anti-fingerprinting in Firefox 55 and 56.
* Converted hundreds of test cases to obey the origin inheritance behavior for data: URIs in support of an [https://github.com/whatwg/html/issues/1753 important spec change].  Intent to ship in Firefox 57.
* Made significant performance improvement on security components in support of Quantum Flow project.
 
=== Content Isolation ===
* Shipping file system user token restriction for Windows content in 56
* Shipping 3rd party legacy extension blocking for Windows content in 56
* Shipping file system read access restrictions for OSX content in 56
* Linux content sandboxing (“level 2”: write restrictions, some syscalls, probably escapable) released in 54. Work to enable read restrictions (enabled at time of writing in Nightly 56 targeting 57 rollout) also completed.
 
== Operations Security ==
* The security audit of Firefox Accounts performed by Cure53 last year was [https://blog.mozilla.org/security/2017/07/18/web-service-audits-firefox-accounts/ publicly released].
* We completed the implementation of [https://zaproxy.blogspot.co.uk/2017/06/scanning-apis-with-zap.html API Scanning with ZAP], to automate vulnerability scanning of our services by leveraging OpenAPI definitions.
* The signing of add-ons has been ported to the [https://github.com/mozilla-services/autograph Autograph] service, where support for SHA-256 PKCS7 signatures will be added.
* TLS Observatory accelerated the loading of CT logs, with currently ~70M certificates recorded. It should reach 200M in Q3.
 
== Security Assurance ==
* New team created to focus on Firefox security assurance
* Working on adding security checks to our build tools to help our developer avoid landing security bugs. First outcome of this project was landing an [https://github.com/mozilla/eslint-plugin-no-unsanitized ESLint plugin] to prevent the unsafe usage of eval, innerHTML etc. in Firefox.
 
== Cross-Team Initiatives ==
* The TLS Canary project has seen the feature [https://github.com/mozilla/tls-canary/releases/tag/v3.1.0 release 3.1]. NSS team is working on treeherder integration.
* [http://ccadb.org/ Common CA Database (CCADB)] access has been granted to the rest of the CAs in Microsoft’s root store (those that are also in Mozilla’s root store already had CA Community licenses/access).
 
= Security Blog Posts & Presentations =
* https://blog.mozilla.org/security/2017/04/04/mozilla-releases-version-2-4-ca-certificate-policy/ (Kathleen)
* https://blog.mozilla.org/security/2017/05/11/relaunching-web-bug-bounty-program/ (April from Enterprise Infosec)
* https://blog.mozilla.org/security/2017/06/28/analysis-alexa-top-1m-sites/ (April from Enterprise Infosec)
* https://blog.mozilla.org/security/2017/07/18/web-service-audits-firefox-accounts/ (Greg from Services Security)
* Francois Marier gave a talk on [https://www.linuxfestnorthwest.org/2017/sessions/security-and-privacy-settings-firefox-power-users security and privacy settings] for Firefox power users at LinuxFest Northwest.
 


----
----
Line 53: Line 5:
* [[SecurityEngineering/Newsletter/2016Q4|2016 4th Quarter]]
* [[SecurityEngineering/Newsletter/2016Q4|2016 4th Quarter]]
* [[SecurityEngineering/Newsletter/2017Q1|2017 1st Quarter]]
* [[SecurityEngineering/Newsletter/2017Q1|2017 1st Quarter]]
* [[SecurityEngineering/Newsletter/2017Q2|2017 2nd Quarter]]
* [[SecurityEngineering/Newsletter/2017Q4|2017 4th Quarter]]

Latest revision as of 03:28, 28 November 2018

This newsletter is no longer maintained.

Previous Editions

Retrieved from "https://wiki.mozilla.org/index.php?title=SecurityEngineering/Newsletter&oldid=1204465"