2 ms·
Potential security considerations identified by the authors of HSTS are manyfold [1]. The most obvious is (14.6) 'Bootstrap MITM Vulnerability' states that sinc
by niftich 10y ago
Potential security considerations identified by the authors of HSTS are manyfold [1]. The most obvious is (14.6) 'Bootstrap MITM Vulnerability' states that since a non-preloaded site's initial contact will be through a non-secure channel, a man-in-the-middle can tamper with the response and never set a HSTS policy, or set an intentionally misconfigured HSTS policy. Preload is designed to mitigate against this, but preloading every single website is... difficult.
[1] https://tools.ietf.org/html/rfc6797#section-14 https://tools.ietf.org/html/rfc6797#section-14
- mkj 10y agoYou can't set a misconfigured policy over http, it needs to be HTTPS with a valid CA.
- niftich 10y agoThat's not entirely clear from the spec. Per section 11.3 [1], if HTST policy is enabled with a self-signed cert, then "then secure connections to that site will fail, per the HSTS design". In my reading, it doesn't say that a compliant user-agent must not set HSTS policies for self-signed certs; rather, it says a compliant user-agent will show an un-remediable error upon attempt to visit the website. [1] https://tools.ietf.org/html/rfc6797#section-11.3 https://tools.ietf.org/html/rfc6797#section-11.3
- icebraining 10y agoRegardless of spec, none of the major browsers accept HSTS policies from sites with self-signed certs.