3 ms·
Until an application chooses to enable HSTS, and their only documented way to update the certificate is the web interface... and there's HSTS. I lost a weekend
by ocdtrekkie 5y ago
Until an application chooses to enable HSTS, and their only documented way to update the certificate is the web interface... and there's HSTS. I lost a weekend to HSTS not long ago.
Essentially the problem with HSTS is it's a malicious choice to remove user agency because the spec intentionally prohibits web browsers from allowing a bypass option, despite the browser being an agent of the user, not the server. It also tells you to talk to your administrator, which is unhelpful when you are the administrator but the browser refuses to allow the administrator to continue.
Every time I've encountered HSTS in practice, it's been because of a perfectly normal certificate error I'm aware of the reason for (usually expiration) and have no real concerns about bypassing, except my own web browser won't let me.
The problem with HSTS (and MTA-STS) is that these are specs designed for internet centralization, where Google or Microsoft controls everything and manages everything[1], and a certificate never lapses. It's not designed for the real world, and neither of these specs would've made it except for that big tech has complete capture of web standards.
[1] Didn't know who the authors were when writing this comment, but the authors of the MTA-STS RFC are in fact, Google, Google, Microsoft, Comcast, and Yahoo.
- tptacek 5y agoThis is a weird analysis. HSTS allows site operators to stand up sites that are HTTPS-only. They ultimately choose the services they want to offer, not you (or else every webserver would just be a remote shell).
- Dylan16807 5y agoHTTPS-only is fine, and I like it overall. But HSTS also cranks up certificate enforcement in a way that is sometimes excessive.
- ocdtrekkie 5y agoStanding up sites that are HTTPS only are a matter of not opening port 80 on your server. HSTS is an action to force access to fail even when you know the content being served, know the server is correct, and understand the issues with certificates. HSTS would be an annoyance, but still manageable if not for the complete removal of our user agency. I think that's really where HSTS moves from a security specification to an abhorrent abuse of monopoly control of web standards. It's less about protecting the user and more about giving Google and such power over what you can and can't view with your browser.
- tptacek 5y agoNo, it's plainly not as simple as "not opening port 80", because an attacker can spoof the server side of port 80. This attack, "SSL stripping", is literally the reason we have HSTS.
- ocdtrekkie 5y agoI think you are missing my core point: That the web browser, as my agent, should do what I tell it. Which means any browser that refuses to load a site because of a cert issue because of HSTS, that browser has been hijacked by the server operator. For any other certificate issue, my browser will allow me to bypass it if I know what I am doing. But because HSTS has hijacked the browser, it will no longer act in my stead unless I fork the browser and recompile it. I consider HSTS to be a malicious specification in this respect.
- tptacek 5y agoYour web browser should do what you tell it to, but it doesn't follow that people who provide apps are obligated to allow you to speak HTTP to them. I don't know what a "malicious specification" is, but your logic about how to lock apps into HTTPS (by simply not listening on 80/tcp) doesn't hold, at all.
- tedunangst 5y agoThat's not the request being made. What people want is for the button that says "this expired cert is fine, whatever" to still be available for hsts https sites.
- tptacek 5y agoI guess I don't understand what that has to do with HSTS, which was not designed for that button.
- 5y ago