Serving data through web APIs Industry best practice: HTTPS and trust the backend. That has two problems
5
HTTPS Interception . 4% of Firefox Updates are being intercepted
6
Compromise of web API
7
Internal Firefox PKI
8
Delivering Content Signatures
9
Verifying Content Signatures
10
Operational Security
11
Some interesting problems
12
Checking certificate validity . Signature verification fails when client clock
13
Measuring validation failures . Firefox drops the data when the signature does not validate
14
Emergency revocations
15
Implementation complexity
Description:
Explore a 19-minute conference talk from USENIX Enigma 2018 featuring Julien Vehent, Firefox Operations Security Lead at Mozilla, discussing the implementation of content signatures to protect Firefox data integrity. Delve into the challenges of securing data transmission between web services and Firefox, including the risks posed by transport intermediaries and potential web server compromises. Learn about the new signing protocol integrated into Firefox, designed to safeguard data exchanged between Mozilla and millions of Firefox installations worldwide. Discover key topics such as updating Firefox, industry best practices for HTTPS, internal Firefox PKI, content signature delivery and verification, operational security, and implementation complexities. Gain insights into specific issues like HTTPS interception, certificate validity checks, measuring validation failures, and emergency revocations.