5 ms·
Why? What's hard about HSTS? Although they don't include subdomains.
by blfr 11y ago
Why? What's hard about HSTS? Although they don't include subdomains.
- LoSboccacc 11y agonot really hard but a limit of HSTS in this particular scenario is that it doesn't automatically redirect you to https if it is the first visit to the web site, which means if the http channel is compromised (the scenario calls for MTM) the hsts can't do anything to fix it (you can simply strip the 302 locations or tell the server that the other endpoint is talking https). only returning visitor will be redirected client side and only if they saw at some point the HSTS header over https.
- aianus 11y agoPlease see the above comment from toomuchtodo about HSTS preloading.
- LoSboccacc 11y agohey that's great! didn't know there was such a process. will list all my stuff. thanks!
- McRask 11y agoThere is still the issue of trust on first use. Unless the domain is preloaded in the browser as HSTS there is no assurance that there won't be at least one HTTP request.
- toomuchtodo 11y agohttps://hstspreload.appspot.com/ https://hstspreload.appspot.com/ Took five minutes to configure the preload directive for HSTS in our nginx headers and submit our domain.
- pas 11y agoDNSSEC, TLS DANE is the proper solution for this.
- MichaelGG 11y agoDNSSEC means creating irrevocable CAs that'd be under essentially-direct control of major governments. No thanks. At least with the current system, if a CA fails to act proper, they can get smacked back. With DNSSEC, if .com starts issuing *.com certs, there's no recourse.
- pas 11y agoHuh? Your site can be already completely hijacked by the same actors. Your browser trusts a lot of CAs so VeriSign (or whoever operates the .com zone) can already issue .com certs. And your only hope is to preload your cert (which is a Chrome only thing, and pretty inefficient and inflexible). The Convergence Project with notaries is an even better solution. But using the DNS as the authoritative source of data and using external parties to keep an eye on that would both lead to efficiency (performance, flexibility) and security (as in from the State).
- aianus 11y agoNo, Namecoin is the proper solution to this. DNSSEC is not safe: 1. It requires centralized trust which can be exploited by governments. 2. It still leaves your domain and PKI in the hands of incompetent rent-seeking registrars who can and do get socially engineered all the time.
- michaelt 11y agoWhat's hard about HSTS? Getting everyone in a large organisation to do it properly. Look at [1] - in particular, look at the list of Google affiliated domains that don't include "include_subdomains": true, "mode": "force-https" blogger.com, youtube.com, gmail.com, google.co.uk, doubleclick.net Google isn't short of competent employees, and they obviously acknowledge the importance of hsts having played a big part in creating it, yet they don't have it turned on. Evidently, getting a single header turned on in a large organisation must be a complicated matter! [1] https://chromium.googlesource.com/chromium/src/net/+/master/http/transport_security_state_static.json https://chromium.googlesource.com/chromium/src/net/+/master/...