net: add HSTS and pinning for Dropbox.

net/http/transport_security_state_static.json

Index: net/http/transport_security_state_static.json
diff --git a/net/http/transport_security_state_static.json b/net/http/transport_security_state_static.json
index 93cdb3c0f7a33241d1faac74967781d2213f4440..578ccfef89b870d7265abc253a2ce54645f50402 100644
--- a/net/http/transport_security_state_static.json
+++ b/net/http/transport_security_state_static.json
@@ -151,6 +151,29 @@
       "static_spki_hashes": [
         "Libertylavabitcom"
       ]
+    },
+    {
+      "name": "dropbox",
+      "static_spki_hashes": [
+        "DigiCertAssuredIDRoot",
+        "DigiCertGlobalRoot",
+        "DigiCertEVRoot",
+        "EntrustRootEC1",
+        "Entrust_G2",
+        "Entrust_EV",
+        "Entrust_2048",
+        "GeoTrustGlobal",
+        "GeoTrustPrimary_G2",
+        "GeoTrustPrimary_G3",
+        "GeoTrustPrimary",
+        "TheGoDaddyGroupClass2",
+        "GoDaddyRoot_G2",
+        "GoDaddySecure",
+        "ThawtePremiumServer",
+        "ThawtePrimaryRootCA_G2",
+        "ThawtePrimaryRootCA_G3",
+        "ThawtePrimaryRootCA"
+      ]
     }
   ],
 
@@ -786,6 +809,8 @@
     { "name": "webcollect.org.uk", "include_subdomains": true, "mode": "force-https" },
     { "name": "www.capitainetrain.com", "mode": "force-https" },
     { "name": "accounts.firefox.com", "include_subdomains": true, "mode": "force-https" },
+    { "name": "dropbox.com", "mode": "force-https", "pins": "dropbox" },
+    { "name": "www.dropbox.com", "include_subdomains": true, "mode": "force-https", "pins": "dropbox" },

[Ryan Sleevi, 2014/07/01 03:03:58]

Weird to include sub-domains for www, but I can see no harm.

 
     // Entries that are only valid if the client supports SNI.
     { "name": "gmail.com", "mode": "force-https", "pins": "google", "snionly": true },