Many of the certificates used by secure websites today are signed using algorithms based on a hash algorithm called SHA-1. The integrity of the hash algorithm used in signing a certificate is a critical element in the security of the & Continue reading

https://blog.mozilla.org/security/2014/09/23/phasing-out-certificates-with-sha-1-based-signature-algorithms/

With the establishment of CSP Level 2, Mozilla shifted gears and reimplemented CSP in C++. This security feature first shipped in Firefox 4 (2011), and until now was implemented in a combination of JavaScript and C++. The new implementation is & Continue reading

https://blog.mozilla.org/security/2014/09/10/faster-csp/

For many years, Mozilla, NIST, the CA/Browser Forum, and others have been encouraging Certification Authorities (CAs) to upgrade their 1024-bit RSA keys to a stronger cryptographic algorithm (either longer RSA keys or ECDSA). We are actively working with CAs to & Continue reading

https://blog.mozilla.org/security/2014/09/08/phasing-out-certificates-with-1024-bit-rsa-keys/

Firefox now supports built-in public key pins, which means that a shortened list of acceptable certificate authorities (CAs) for participating sites is built into Firefox. In this first stage of pinning roll-out, protected domains include addons.mozilla.org and Twitter, to be & Continue reading

https://blog.mozilla.org/security/2014/09/02/public-key-pinning/

As we indicated in the post titled “MDN Disclosure”, we began several remediation measures, including a review of data practices surrounding user data. We have kicked off a larger project to better our practices around data, including with respect to & Continue reading

https://blog.mozilla.org/security/2014/08/27/update-on-reviewing-our-data-practices-and-bugzilla-development-database-disclosure/

In April, we announced an upcoming certificate verification library designed from the ground up to be fast and secure. A few weeks ago, this new library  known as mozilla::pkix  shipped with Firefox and is enabled by default. Please & Continue reading

https://blog.mozilla.org/security/2014/08/20/mozillapkix-ships-in-firefox/