3 ms·

> In other words: if you can't safely HPKP your secure messaging system (cough), you probably aren't yet qualified to be running it And of course, if you do fi

by eganist 10y ago

> In other words: if you can't safely HPKP your secure messaging system (cough), you probably aren't yet qualified to be running it And of course, if you do find a defect like this in a web based secure messaging system that relies on HPKP, it'd be great if you'd report it directly to the service and allow them to fix the defect, per responsible disclosure anyway.

tptacek 10y ago
Well, the real risk here is that it creates a new consequence for being hacked by a criminal, right. So I can't cop out and say "people should report instead of playing HPKP games". On the other hand, it's an internalized risk, which is kind of a beautiful thing: so many of the risks we create through poor security are externalized to end-users --- so much so that you can run a secure messaging site, get owned up, cost thousands of people their privacy, and still keep chugging along as if nothing happened. This particular risk though just wallops the owners of the site.
- eganist 10y ago
  > Well, the real risk here is that it creates a new consequence for being hacked by a criminal, right. No disagreement from me here, which was one reason we set out to talk about RansomPKP at BH/DC in the first place :) That said, I do think this can, and should, be reported to site owners. You're not going to see much innovation if people don't take time to futz around with technologies and see what they can do with them. HPKP has plenty of potential to hurt, but as you alluded to, it's generally just your own feet in harm's way. > This particular risk though just wallops the owners of the site. Yeah, that's what the (cough) team was going for.
  - tptacek 10y ago
    Sorry, I was being snarky, because there's a secure messenger that apparently did commit PKP suicide.
    - deleted 10y ago
      [deleted]
- greggman 10y ago
  Unless I'm mis-understanding it doesn't just wallop the owner of the site. It wallops all of that site's users as well. I know Google is less likely to be walloped but imagine a site similar to Google docs or gmail went down until the key expires. That's not just going to affect the site, it affects all of it's users.
  - tptacek 10y ago
    Users can still get their data; the owners need to stand up another hostname. They're inconvenienced. But the attack is devastating to companies, who depend on user convenience to attract and retain users.

by eganist 10y ago

tptacek 10y ago

Well, the real risk here is that it creates a new consequence for being hacked by a criminal, right. So I can't cop out and say "people should report instead of playing HPKP games". On the other hand, it's an internalized risk, which is kind of a beautiful thing: so many of the risks we create through poor security are externalized to end-users --- so much so that you can run a secure messaging site, get owned up, cost thousands of people their privacy, and still keep chugging along as if nothing happened. This particular risk though just wallops the owners of the site.

eganist 10y ago
> Well, the real risk here is that it creates a new consequence for being hacked by a criminal, right. No disagreement from me here, which was one reason we set out to talk about RansomPKP at BH/DC in the first place :) That said, I do think this can, and should, be reported to site owners. You're not going to see much innovation if people don't take time to futz around with technologies and see what they can do with them. HPKP has plenty of potential to hurt, but as you alluded to, it's generally just your own feet in harm's way. > This particular risk though just wallops the owners of the site. Yeah, that's what the (cough) team was going for.
- tptacek 10y ago
  Sorry, I was being snarky, because there's a secure messenger that apparently did commit PKP suicide.
  - deleted 10y ago
    [deleted]
greggman 10y ago
Unless I'm mis-understanding it doesn't just wallop the owner of the site. It wallops all of that site's users as well. I know Google is less likely to be walloped but imagine a site similar to Google docs or gmail went down until the key expires. That's not just going to affect the site, it affects all of it's users.
- tptacek 10y ago
  Users can still get their data; the owners need to stand up another hostname. They're inconvenienced. But the attack is devastating to companies, who depend on user convenience to attract and retain users.