3 ms·

So now the flip side question. How would say a corporate SSL/TLS proxy, which is effectively a MITM, bypass this security feature? I can see the TOFU is easy to

So now the flip side question. How would say a corporate SSL/TLS proxy, which is effectively a MITM, bypass this security feature? I can see the TOFU is easy to defeat by dropping the header before it gets to the client, but what if they're allowed to roam on and off the proxy?

tshtf 11y ago
Google Chrome allows TLS MITM proxies to override HPKP settings (which is not without controversy): We deem this acceptable because the proxy or MITM can only be effective if the client machine has already been configured to trust the proxy’s issuing certificate — that is, the client is already under the control of the person who controls the proxy (e.g. the enterprise’s IT administrator). If the client does not trust the private trust anchor, the proxy’s attempt to mediate the connection will fail as it should. https://www.chromium.org/Home/chromium-security/security-faq#TOC-How-does-key-pinning-interact-with-local-proxies-and-filters- https://www.chromium.org/Home/chromium-security/security-faq... https://code.google.com/p/chromium/issues/detail?id=561646 https://code.google.com/p/chromium/issues/detail?id=561646
- pfg 11y ago
  Firefox defaults to the same implementation[1]. I'm personally fine with this. MITM proxies are a valid use case. I do think that all parties should be made aware of it, but that's probably something that has to be fixed via laws (I think some European countries forbid this practice unless it's been made clear that there can be no expectation of privacy on a company-provided device). [1]: https://wiki.mozilla.org/SecurityEngineering/Public_Key_Pinning#How_to_use_pinning https://wiki.mozilla.org/SecurityEngineering/Public_Key_Pinn...
rakoo 11y ago
I guess the proxy would add both its own key and upstream keys, as is allowed by the spec; in a way the proxy key will act as the normal key and the true site key will act as a backup key. The fun begins with report uris, it doesn't seem like there's a way to specify multiple of them.
hobarrera 11y ago
> How would say a corporate SSL/TLS proxy, which is effectively a MITM, bypass this security feature? The whole idea of this security feature is that MITMs can't bypass it. It would be worthless if proxies could bypass it.

tshtf 11y ago

Google Chrome allows TLS MITM proxies to override HPKP settings (which is not without controversy): We deem this acceptable because the proxy or MITM can only be effective if the client machine has already been configured to trust the proxy’s issuing certificate — that is, the client is already under the control of the person who controls the proxy (e.g. the enterprise’s IT administrator). If the client does not trust the private trust anchor, the proxy’s attempt to mediate the connection will fail as it should. https://www.chromium.org/Home/chromium-security/security-faq#TOC-How-does-key-pinning-interact-with-local-proxies-and-filters- https://www.chromium.org/Home/chromium-security/security-faq... https://code.google.com/p/chromium/issues/detail?id=561646 https://code.google.com/p/chromium/issues/detail?id=561646

pfg 11y ago
Firefox defaults to the same implementation[1]. I'm personally fine with this. MITM proxies are a valid use case. I do think that all parties should be made aware of it, but that's probably something that has to be fixed via laws (I think some European countries forbid this practice unless it's been made clear that there can be no expectation of privacy on a company-provided device). [1]: https://wiki.mozilla.org/SecurityEngineering/Public_Key_Pinning#How_to_use_pinning https://wiki.mozilla.org/SecurityEngineering/Public_Key_Pinn...

rakoo 11y ago

I guess the proxy would add both its own key and upstream keys, as is allowed by the spec; in a way the proxy key will act as the normal key and the true site key will act as a backup key. The fun begins with report uris, it doesn't seem like there's a way to specify multiple of them.

hobarrera 11y ago

> How would say a corporate SSL/TLS proxy, which is effectively a MITM, bypass this security feature? The whole idea of this security feature is that MITMs can't bypass it. It would be worthless if proxies could bypass it.