Changes

Jump to: navigation, search

Security/Features/TLS Telemetry

994 bytes added, 20:13, 14 December 2011
no edit summary
We have decided to collect a smaller subset of the data in the initial feature. The study will be updated when more data is exposed through NSS.
|Feature overview=The goal of this telemetry study is to collect SSL/TLS related data errors that our Firefox users encounter in their daily during browsing. This The data can be used to decide whether Firefox should support legacy / less secure protocols such as weak keys or SSLv2 .
|Feature users and use cases=The target users are Firefox users.
'''Use Cases'''
*Collect cipher suites exchanged during handshake and negotiated cipher ** Ciphersuites in PSM are ordered in decreasing preference. The SSL/TLS specification says that the client should send their supported ciphersuites in this order. The server then choose the most preferred ciphersuite that it also supports.** Collecting this data allows us to make decisions whether to remove certain weaker ciphers from our supported list. *Collect SSL/TLSversion** This is the version of SSL/TLS that ends up being negotiated. This doesn't correspond directly to whether the client has the preference for "Use SSL 3.0" or "Use TLS 1.0" enabled.** The resulting version may be different due to what the server supports.*Collect certificate key strength (bits)** This is the server RSA public key modulus. A larger modulus is preferred** It would be desirable to disable weak certificates. {{bug|360126}}*Collect SSL/TLS/SSL certificate related errors*Collect count of TLS intolerant websites*What kind of errors are our users encountering? * Some websites do not implement the SSL protocol correctly and there is special handling for those cases.**Domain mismatchIn those cases, expired, untrusted issuer, etcFirefox tries to reconnect but downgrading from TLS 1.0 to SSL 3.0** It may be possible to remove this downgrading if the number of TLS intolerant sites is small enough.
|Feature dependencies=N/A
|Feature requirements=# Collect type of SSL/TLS error
We will determine the strength of the negotiated channel by collecting: negotiated ciphersuite, SSL/TLS version, server public key bits, whether the server is TLS intolerant.
 
|Feature ux design=The study uses the default Telemetry UI/UX. The only code changes are to add more probes. Histogram names / descriptions may need to be localized.
|Feature implementation plan=* Determine best areas of code to insert Telemetry probes
Confirm
110
edits

Navigation menu