5 ms·

Good Lord, someone took the dumpster fire that was HSTS and made it for mail servers? Heaven help us all and have mercy on our souls. I wanted to then follow u

Good Lord, someone took the dumpster fire that was HSTS and made it for mail servers? Heaven help us all and have mercy on our souls. I wanted to then follow up with an insightful or interesting comment but I am at a loss.

Macha 5y ago
HSTS itself is fine? It just means "please only contact me over TLS for X amount of time". The only complaint I heard about was adtech companies using it for fingerprinting. Are you sure you're not thinking of HPKP?
- Karunamon 5y ago
  Problem is "X amount of time" is usually "months-to-years" and there's no override.
  - Macha 5y ago
    But as for as stipulations go, "Must use TLS" seems pretty tame.
- ocdtrekkie 5y ago
  Until an application chooses to enable HSTS, and their only documented way to update the certificate is the web interface... and there's HSTS. I lost a weekend to HSTS not long ago. Essentially the problem with HSTS is it's a malicious choice to remove user agency because the spec intentionally prohibits web browsers from allowing a bypass option, despite the browser being an agent of the user, not the server. It also tells you to talk to your administrator, which is unhelpful when you are the administrator but the browser refuses to allow the administrator to continue. Every time I've encountered HSTS in practice, it's been because of a perfectly normal certificate error I'm aware of the reason for (usually expiration) and have no real concerns about bypassing, except my own web browser won't let me. The problem with HSTS (and MTA-STS) is that these are specs designed for internet centralization, where Google or Microsoft controls everything and manages everything[1], and a certificate never lapses. It's not designed for the real world, and neither of these specs would've made it except for that big tech has complete capture of web standards. [1] Didn't know who the authors were when writing this comment, but the authors of the MTA-STS RFC are in fact, Google, Google, Microsoft, Comcast, and Yahoo.
  - tptacek 5y ago
    This is a weird analysis. HSTS allows site operators to stand up sites that are HTTPS-only. They ultimately choose the services they want to offer, not you (or else every webserver would just be a remote shell).
    - Dylan16807 5y ago
      HTTPS-only is fine, and I like it overall. But HSTS also cranks up certificate enforcement in a way that is sometimes excessive.
    - ocdtrekkie 5y ago
      Standing up sites that are HTTPS only are a matter of not opening port 80 on your server. HSTS is an action to force access to fail even when you know the content being served, know the server is correct, and understand the issues with certificates. HSTS would be an annoyance, but still manageable if not for the complete removal of our user agency. I think that's really where HSTS moves from a security specification to an abhorrent abuse of monopoly control of web standards. It's less about protecting the user and more about giving Google and such power over what you can and can't view with your browser.
      - tptacek 5y ago
        No, it's plainly not as simple as "not opening port 80", because an attacker can spoof the server side of port 80. This attack, "SSL stripping", is literally the reason we have HSTS.
        ocdtrekkie 5y ago
        I think you are missing my core point: That the web browser, as my agent, should do what I tell it. Which means any browser that refuses to load a site because of a cert issue because of HSTS, that browser has been hijacked by the server operator. For any other certificate issue, my browser will allow me to bypass it if I know what I am doing. But because HSTS has hijacked the browser, it will no longer act in my stead unless I fork the browser and recompile it. I consider HSTS to be a malicious specification in this respect.
tptacek 5y ago
You could start by explaining why you think HSTS is a dumpster fire. The idea behind HSTS is to ensure that sites intended only to be used over HTTPS are used only over HTTPS; it's not the kind of thing you're supposed to toggle or fiddle with.
- ocdtrekkie 5y ago
  I have written a neighbor comment. But in short: It removes user agency in the browser, and more than often solely exists to interfere with troubleshooting for the administrator trying to fix the issue.
  - tptacek 5y ago
    It exists because without HSTS, attackers can defeat HTTPS trivially by spoofing HTTP responses to attempts to visit the (unintended) "http" site.

Macha 5y ago

HSTS itself is fine? It just means "please only contact me over TLS for X amount of time". The only complaint I heard about was adtech companies using it for fingerprinting. Are you sure you're not thinking of HPKP?

Karunamon 5y ago
Problem is "X amount of time" is usually "months-to-years" and there's no override.
- Macha 5y ago
  But as for as stipulations go, "Must use TLS" seems pretty tame.
ocdtrekkie 5y ago
Until an application chooses to enable HSTS, and their only documented way to update the certificate is the web interface... and there's HSTS. I lost a weekend to HSTS not long ago. Essentially the problem with HSTS is it's a malicious choice to remove user agency because the spec intentionally prohibits web browsers from allowing a bypass option, despite the browser being an agent of the user, not the server. It also tells you to talk to your administrator, which is unhelpful when you are the administrator but the browser refuses to allow the administrator to continue. Every time I've encountered HSTS in practice, it's been because of a perfectly normal certificate error I'm aware of the reason for (usually expiration) and have no real concerns about bypassing, except my own web browser won't let me. The problem with HSTS (and MTA-STS) is that these are specs designed for internet centralization, where Google or Microsoft controls everything and manages everything[1], and a certificate never lapses. It's not designed for the real world, and neither of these specs would've made it except for that big tech has complete capture of web standards. [1] Didn't know who the authors were when writing this comment, but the authors of the MTA-STS RFC are in fact, Google, Google, Microsoft, Comcast, and Yahoo.
- tptacek 5y ago
  This is a weird analysis. HSTS allows site operators to stand up sites that are HTTPS-only. They ultimately choose the services they want to offer, not you (or else every webserver would just be a remote shell).
  - Dylan16807 5y ago
    HTTPS-only is fine, and I like it overall. But HSTS also cranks up certificate enforcement in a way that is sometimes excessive.
  - ocdtrekkie 5y ago
    Standing up sites that are HTTPS only are a matter of not opening port 80 on your server. HSTS is an action to force access to fail even when you know the content being served, know the server is correct, and understand the issues with certificates. HSTS would be an annoyance, but still manageable if not for the complete removal of our user agency. I think that's really where HSTS moves from a security specification to an abhorrent abuse of monopoly control of web standards. It's less about protecting the user and more about giving Google and such power over what you can and can't view with your browser.
    - tptacek 5y ago
      No, it's plainly not as simple as "not opening port 80", because an attacker can spoof the server side of port 80. This attack, "SSL stripping", is literally the reason we have HSTS.
      - ocdtrekkie 5y ago
        I think you are missing my core point: That the web browser, as my agent, should do what I tell it. Which means any browser that refuses to load a site because of a cert issue because of HSTS, that browser has been hijacked by the server operator. For any other certificate issue, my browser will allow me to bypass it if I know what I am doing. But because HSTS has hijacked the browser, it will no longer act in my stead unless I fork the browser and recompile it. I consider HSTS to be a malicious specification in this respect.

tptacek 5y ago

You could start by explaining why you think HSTS is a dumpster fire. The idea behind HSTS is to ensure that sites intended only to be used over HTTPS are used only over HTTPS; it's not the kind of thing you're supposed to toggle or fiddle with.

ocdtrekkie 5y ago
I have written a neighbor comment. But in short: It removes user agency in the browser, and more than often solely exists to interfere with troubleshooting for the administrator trying to fix the issue.
- tptacek 5y ago
  It exists because without HSTS, attackers can defeat HTTPS trivially by spoofing HTTP responses to attempts to visit the (unintended) "http" site.