diff --git a/Optional-Hardening.md b/Optional-Hardening.md index a6cc154..23a4865 100644 --- a/Optional-Hardening.md +++ b/Optional-Hardening.md @@ -118,6 +118,19 @@ user_pref("default-browser-agent.enabled", false); *** +### Public Key Pinning +[Public Key Pinning](https://wiki.mozilla.org/SecurityEngineering/Public_Key_Pinning) (PKP) is a tool that boosts the safety of [SSL certificates](https://www.cloudflare.com/learning/ssl/what-is-an-ssl-certificate/) by linking a website to its unique security key. This process ensures that the website you're visiting is real and not fake. PKP stops any attempts to trick your computer into connecting with a fraudulent website. + +:warning: Sometimes antivirus software — or some other [source](https://github.com/yokoffing/Betterfox/issues/232#issuecomment-1732346856) — won't let you open websites ([example](https://www.reddit.com/r/firefox/comments/16mlv15/kaspersky_cant_scan_encrypted_connections_with/)). + +``` +// PREF: enforce certificate pinning +// [ERROR] MOZILLA_PKIX_ERROR_KEY_PINNING_FAILURE +user_pref("security.cert_pinning.enforcement_level", 2); +``` + +*** + ### Require Safe Negotiation :warning: Some sites, like `EA.com`, will not let you login due to their weak encryption.