Failed to remove debugging options in Firefox
It is possible to set an environment variable, SSLKEYLOGFILE, that when set will export the CLIENT_RANDOM of Firefox's SSL/TLS handshakes to a file. This can include a Windows file share url - meaning that the CLIENT_RANDOM data would then be streamed to the remote server. Furthermore, I think this means that a better attacker can attach to firefox and simply use these functions to extract keying information.
I propose that we disable this functionality and also that we remove the code that makes this possible - or even better - we hook it and panic if someone tries to use it.
Relevant Mozilla bug: https://bugzilla.mozilla.org/show_bug.cgi?id=908046 Relevant Google discussion: https://groups.google.com/forum/#!topic/mozilla.dev.tech.crypto/bu3b9x12c1Q
I have tested this against Tor Browser by running this command:
SSLKEYLOGFILE=/tmp/tb-keys.log ./start-tor-browser.desktop