3 ms·

Two points about HPKP bypass: First, keep in mind the alternative. AVs, security suites, legitimate corporate monitoring tools (and malware) will hook the brow

Two points about HPKP bypass: First, keep in mind the alternative. AVs, security suites, legitimate corporate monitoring tools (and malware) will hook the browser function calls to remove any warning/block, causing crashes and vulnerabilities. If they can plant a root, they can do that. (Unless you give them a easy flag to toggle, but then how is it different from just trusting the certificate?) Consider that most AVs are doing exactly what Dell did, but "correctly". There are more than you probably think. And they will keep doing it (now via horrible binary hooking), because an AV that "protects your HTTPS traffic" sells more than one that doesn't. THAT will increase the attack surface exposed to the outside world (see Tavis Ormandy's work), only to reduce the "attack surface" exposed to your own manufacturer or system. Second, please consider with skepticism any proposal that solves any concern by adding more UI. Users can barely understand the green lock (as anyone following the excellent work of Adrienne Porter Felt knows), how is the user supposed to react to "hey, this site has a HPKP pin that is being overridden by a local root, are you sure it's the IT Dept or the AV vendor but not your manufacturer screwing up?". We settled the "should you defend from root" discussion in Linux years ago, do we have to start again from scratch with Windows?

shkkmo 11y ago
> hey, this site has a HPKP pin that is being overridden by a local root, are you sure it's the IT Dept or the AV vendor but not your manufacturer screwing up? Yeah, that is a crappy error message that will confuse and scare people. However, it is not that hard to write a better one: "Your connection to {this site} may be using a security certificate other than the one specified by {this site}. This may be a part of your Antivirus or Corporate network firewall. However, be aware that it is possible that groups other than you and the operator of this site may have access to any data you view at or send to this site." Then handle this warning the same way that self-signed or expired certificates are handled. > THAT will increase the attack surface exposed to the outside world (see Tavis Ormandy's work), only to reduce the "attack surface" exposed to your own manufacturer or system. How does it increase the attack surface? The attack surface of 'installing an antivirus that has access to your https traffic and can perform a MITM on it' is the same either way, right?
- FiloSottile 11y ago
  I don't think any Chrome error mention "certificates" anymore, and for good reason. Anyway, what is the user supposed to do after reading your (totally easier) message? It still lacks any actionability, because there is no clear action the user can take if their system is that compromised. I consider hooking into a x509 verification stack some orders of magnitude harder than parsing HTML.
  - shkkmo 11y ago
    > Anyway, what is the user supposed to do after reading your (totally easier) message? It still lacks any actionability, because there is no clear action the user can take if their system is that compromised. Display a "Back to Safety" and a "Continue Anyway" button, and then don't re-display the warning for that site until the browser is re-launched or some period of time passes.

shkkmo 11y ago

> hey, this site has a HPKP pin that is being overridden by a local root, are you sure it's the IT Dept or the AV vendor but not your manufacturer screwing up? Yeah, that is a crappy error message that will confuse and scare people. However, it is not that hard to write a better one: "Your connection to {this site} may be using a security certificate other than the one specified by {this site}. This may be a part of your Antivirus or Corporate network firewall. However, be aware that it is possible that groups other than you and the operator of this site may have access to any data you view at or send to this site." Then handle this warning the same way that self-signed or expired certificates are handled. > THAT will increase the attack surface exposed to the outside world (see Tavis Ormandy's work), only to reduce the "attack surface" exposed to your own manufacturer or system. How does it increase the attack surface? The attack surface of 'installing an antivirus that has access to your https traffic and can perform a MITM on it' is the same either way, right?

FiloSottile 11y ago
I don't think any Chrome error mention "certificates" anymore, and for good reason. Anyway, what is the user supposed to do after reading your (totally easier) message? It still lacks any actionability, because there is no clear action the user can take if their system is that compromised. I consider hooking into a x509 verification stack some orders of magnitude harder than parsing HTML.
- shkkmo 11y ago
  > Anyway, what is the user supposed to do after reading your (totally easier) message? It still lacks any actionability, because there is no clear action the user can take if their system is that compromised. Display a "Back to Safety" and a "Continue Anyway" button, and then don't re-display the warning for that site until the browser is re-launched or some period of time passes.