6 ms·
Do those bypasses apply for HSTS-preloaded certs as well? My understanding is that the intention of HSTS preloading is to address this sort of attack, but haven
by pcl 10y ago
Do those bypasses apply for HSTS-preloaded certs as well? My understanding is that the intention of HSTS preloading is to address this sort of attack, but haven't dug through the browser code to see what's happening in standard distributions.
- ikeboy 10y agoYes. It's explicitly not part of their threat model: https://www.chromium.org/Home/chromium-security/security-faq#TOC-How-does-key-pinning-interact-with-local-proxies-and-filters- https://www.chromium.org/Home/chromium-security/security-faq...
- gruez 10y agoThe point of HSTS (and preloading) is to protect clients from sslstrip (and similar attacks). as in, client types in a http url, and the attacker prevents the http connection from being upgraded.
- pcl 10y agoThat's one of the goals of HSTS itself, but preloading designed to allow secure-only communications when establishing a connection to a hitherto-unused site, so that MITM attacks can't simply provide their own certs on first connect.
- niij 10y agoIf you have a Root Cert installed on your system, and they are MITMing traffic to a HSTS site with that Cert then your browser will give no warnings (for HSTS or non-HSTS sites).