5 ms·

I don't understand. I am sure I am missing something obvious but maybe you can help me understand. The purpose of STS is to avoid the user accidentally going t

I don't understand. I am sure I am missing something obvious but maybe you can help me understand. The purpose of STS is to avoid the user accidentally going to the http address of a page instead of the https page. This is achieved by a special HTTP header that is sent from the server to the browser. The browser remembers that the server wishes to be contacted only over https, and from that moment on all network traffic from the browser to that domain will only be possible over https. No way for the user to accidentally type http://gmail.com/ http://gmail.com/. How is this different from a 302 location redirect header from the http:// http:// url to the https:// https:// url?

EricButler 15y ago
An attacker could intercept that initial http:// http:// url and provide their own destination for the browser to visit instead. HSTS prevents this from happening once the domain is in the cache (or pre-loaded).
trotsky 15y ago
An attacker that is able to MITM your traffic or poison your DNS can steal your session before you ever get to the trusted https url. http://www.thoughtcrime.org/software/sslstrip/ http://www.thoughtcrime.org/software/sslstrip/
- y0ghur7_xxx 15y ago
  But that is a problem with STS too. That is why google is HSTS preloading a lot of google domains in their browser (they hardcode the domains). Couldn't they just hardcode the redirect so that if the user types http://gmail.com/ http://gmail.com/ chrome replaces it with https://gmail.com https://gmail.com?
  - trotsky 15y ago
    STS solves the problem unless the attacker has a fraudulent certificate for the domain you are reaching that is signed by a CA you trust. Presumably this is far fewer attackers than those who could manipulate your DNS or are on your local network to ARP in as a middleman. Basically, two different problems - the trust only X CA for xxx.com wouldn't ever get to come into play if someone using sslstrip simply keeps you from ever going to tls.
  - extension 15y ago
    It's a problem with STS the first time the browser visits a particular site. Once the browser receives the STS header, all future requests to that site will be over HTTPS.
JoachimSchipper 15y ago
If an attacker controls DNS (which is doable), he could just not issue the redirect and you'd happily tell your GMail password to his server. Also, redirecting from e.g. http://gmail.com/login?user=me&pass=secret http://gmail.com/login?user=me&pass=secret to https://gmail.com/login?user=me&pass=secret https://gmail.com/login?user=me&pass=secret is not that useful, so this can also help with some forms.

EricButler 15y ago

An attacker could intercept that initial http:// http:// url and provide their own destination for the browser to visit instead. HSTS prevents this from happening once the domain is in the cache (or pre-loaded).

trotsky 15y ago

An attacker that is able to MITM your traffic or poison your DNS can steal your session before you ever get to the trusted https url. http://www.thoughtcrime.org/software/sslstrip/ http://www.thoughtcrime.org/software/sslstrip/

y0ghur7_xxx 15y ago
But that is a problem with STS too. That is why google is HSTS preloading a lot of google domains in their browser (they hardcode the domains). Couldn't they just hardcode the redirect so that if the user types http://gmail.com/ http://gmail.com/ chrome replaces it with https://gmail.com https://gmail.com?
- trotsky 15y ago
  STS solves the problem unless the attacker has a fraudulent certificate for the domain you are reaching that is signed by a CA you trust. Presumably this is far fewer attackers than those who could manipulate your DNS or are on your local network to ARP in as a middleman. Basically, two different problems - the trust only X CA for xxx.com wouldn't ever get to come into play if someone using sslstrip simply keeps you from ever going to tls.
- extension 15y ago
  It's a problem with STS the first time the browser visits a particular site. Once the browser receives the STS header, all future requests to that site will be over HTTPS.

JoachimSchipper 15y ago

If an attacker controls DNS (which is doable), he could just not issue the redirect and you'd happily tell your GMail password to his server. Also, redirecting from e.g. http://gmail.com/login?user=me&pass=secret http://gmail.com/login?user=me&pass=secret to https://gmail.com/login?user=me&pass=secret https://gmail.com/login?user=me&pass=secret is not that useful, so this can also help with some forms.