SecurityEngineering/2014/Q3Goals: Difference between revisions
Jump to navigation
Jump to search
No edit summary |
|||
| Line 9: | Line 9: | ||
;Who: Tanvi, Christoph, Garrett, Sid | ;Who: Tanvi, Christoph, Garrett, Sid | ||
* {{ | * {{ok|Gecko Security Hooks: Finish code and debugging for New Channel API, start getting reviews}} (dri=tanvi) | ||
* {{ | * {{ok|Gecko Security Hooks: Create plan for addon compatibility}} (dri=tanvi) | ||
* {{ | * {{done|CSP: Remove old JS implementation from mozilla-central}} (dri=sstamm) | ||
* {{new|Evangelism: Security Open Mic presentation + blog post about new CSP implementation, maybe again as brown bag.}} (dri=sstamm) | * {{new|Evangelism: Security Open Mic presentation + blog post about new CSP implementation, maybe again as brown bag.}} (dri=sstamm) | ||
* {{ | * {{ok|''[stretch goal]'' CSP: Fix majority of CSP 1.1 compatibility bugs}} ([https://etherpad.mozilla.org/CSP-1-1 planning etherpad])(dri=ckerschb) | ||
== Tracking Protection == | == Tracking Protection == | ||
Revision as of 16:38, 4 August 2014
This is a heavy-Implement quarter (as opposed to the other strategic actions in our SecurityEngineering/Strategy).
(Also linked from Platform/2014-Q3-Goals#Security_.26_Privacy_Engineering).
Content Security
- Outcome
- Progress towards more robust security hooks for better correctness in content security features like CSP, adblock, etc.
- Who
- Tanvi, Christoph, Garrett, Sid
- [ON TRACK] Gecko Security Hooks: Finish code and debugging for New Channel API, start getting reviews (dri=tanvi)
- [ON TRACK] Gecko Security Hooks: Create plan for addon compatibility (dri=tanvi)
- [DONE] CSP: Remove old JS implementation from mozilla-central (dri=sstamm)
- [NEW] Evangelism: Security Open Mic presentation + blog post about new CSP implementation, maybe again as brown bag. (dri=sstamm)
- [ON TRACK] [stretch goal] CSP: Fix majority of CSP 1.1 compatibility bugs (planning etherpad)(dri=ckerschb)
Tracking Protection
- Outcome
- Better user control (and site control) over metadata on the wire and collected by third parties.
- Who
- Monica, Garrett, Sid, Georgios
- [NEW] Referer: Finish implementation of <meta> referrer control with volunteer help (dri=sstamm)
- [NEW] Land first implementation of protection in Fx 33/34 off by default. (dri=mmc)
Communications Security
- Outcome
- Fresher/more accurate revocation information and progress towards defeating certificate misissuance and Man-In-The-Middle attacks.
- Who
- Richard, Kathleen, Keeler, Camilo, Harsh, Garrett, Monica
- [CARRY OVER] SSL Error Reporting finish first implementation of ssl error reporting feature. (dri=grobinson)
- [NEW] HPKP - implement pinning http header (dri=cviecco)
- [NEW] Update roadmap for Cert Revocation improvements (dri=rbarnes)
- [NEW] Create a mechanism to provision phones with an alternate cert (dri=mgoodwin)
- [NEW] Add measurement/enforcement of compliance with CABF Baseline Requirements (dri=keeler)
- [NEW] Create a tool for testing CA certificate compliance and EV-readiness (dri=keeler)
- [NEW] Add support for key wrap/unwrap and ECC in WebCrypto (dri=rbarnes)
- [NEW] [stretch goal] Enable revocation of intermediate CAs through block list service (dri=harsh, keeler)
- [NEW] [stretch goal] Require 2048-bit keys for built-in root certificates (dri=kathleen)
- [NEW] [stretch goal] Get CA Program data into one database (dri=kathleen)