4 ms·

1) You can address it in Chrome with pinning [1]. Built in pins require that you be a significant site, but you can also set them with HTTP headers [2]. [1] ht

by agl 15y ago

1) You can address it in Chrome with pinning [1]. Built in pins require that you be a significant site, but you can also set them with HTTP headers [2]. [1] http://www.imperialviolet.org/2011/05/04/pinning.html http://www.imperialviolet.org/2011/05/04/pinning.html [2] http://tools.ietf.org/html/draft-ietf-websec-key-pinning-01 http://tools.ietf.org/html/draft-ietf-websec-key-pinning-01 This is a rather poor solution. The longer term one is Certificate Transparency: http://www.links.org/?p=1219 http://www.links.org/?p=1219 2) is solved with HSTS [3]. You can contact me (@chromium.org) to be built in. There isn't a notability requirement. [3] http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security 3) The BEAST attack was tough to pull off and is fixed with Chrome, FF10 and IE. http://www.imperialviolet.org/2012/01/15/beastfollowup.html http://www.imperialviolet.org/2012/01/15/beastfollowup.html 4) Yep, cookies must be marked secure. HSTS can also fix this my eliminating the insecure requests. Even with secure cookies (but without HSTS), a MITM can also set the cookie. (i.e. to log you in to their account before you hit 'send' and then to log you back into yours before you notice the problem.)

JoachimSchipper 15y ago
Good points. Additionally: if you control the client, you can also trust your own CA only, or even just require a specific certificate.
skrebbel 15y ago
2) is solved with HSTS [3]. You can contact me (@chromium.org) to be built in. There isn't a notability requirement. I don't understand that. If I serve http://example.com/mypage http://example.com/mypage which has a link to http://mint.com/justin http://mint.com/justin, you won't convert that to https://mint.com/justing https://mint.com/justing, right? Even if example.com has HSTS enabled? Cause that would assume that mint.com has https, or else the whole thing breaks. Cause in that case a man in the middle can just insert links to other domains (say, http://examp1e.com/myotherpage http://examp1e.com/myotherpage when I was serving a link to http://example.com/myotherpage http://example.com/myotherpage) and still have the attack work. Like the GP said, only starting at an HTTPS page would solve this. But you're the expert and I'm not, so what am I missing? :-)
- coderrr 15y ago
  as long as mint.com has HSTS and either the user has been there once before or it was hard coded into the browser as an HSTS domain then the browser will never visit http://mint.com http://mint.com, it will immediately go to https://mint.com https://mint.com EDIT: and well it doesn't seem that mint.com even has HSTS enabled... so bad example :P

by agl 15y ago

JoachimSchipper 15y ago

Good points. Additionally: if you control the client, you can also trust your own CA only, or even just require a specific certificate.

skrebbel 15y ago

2) is solved with HSTS [3]. You can contact me (@chromium.org) to be built in. There isn't a notability requirement. I don't understand that. If I serve http://example.com/mypage http://example.com/mypage which has a link to http://mint.com/justin http://mint.com/justin, you won't convert that to https://mint.com/justing https://mint.com/justing, right? Even if example.com has HSTS enabled? Cause that would assume that mint.com has https, or else the whole thing breaks. Cause in that case a man in the middle can just insert links to other domains (say, http://examp1e.com/myotherpage http://examp1e.com/myotherpage when I was serving a link to http://example.com/myotherpage http://example.com/myotherpage) and still have the attack work. Like the GP said, only starting at an HTTPS page would solve this. But you're the expert and I'm not, so what am I missing? :-)

coderrr 15y ago
as long as mint.com has HSTS and either the user has been there once before or it was hard coded into the browser as an HSTS domain then the browser will never visit http://mint.com http://mint.com, it will immediately go to https://mint.com https://mint.com EDIT: and well it doesn't seem that mint.com even has HSTS enabled... so bad example :P