3 ms·

TACK looks cool. I read through the RFC and have some questions .... At first I thought an active MITM could drop TACK negotiation from ClientHello and wait 30

TACK looks cool. I read through the RFC and have some questions .... At first I thought an active MITM could drop TACK negotiation from ClientHello and wait 30 days until pins expire, but as I read it, I think that should result in a "contradicted" pin. You could do browser profiling though, and only MITM clients which don't send a TackExtension in the ClientHello, or behaviourally look like IE, say. I wonder if it would have been better not to indicate that client supports TACK? (Maybe constraints not obvious to me). The other thing I'm not sure about is overlapping TACK handling. I don't see what's to prevent an MITM from adding an additional new TACK of their own in the ServerHello, gradually superseding the "valid" TACK. That would take like 60-90 days though. This looks like a massive improvement, although I wonder if it actually protects clients which do not support the extension?

tptacek 13y ago
You could do that, but you'd be outed immediately by anyone who checked two TLS connections back-to-back for consistency.
- xyzzy123 13y ago
  I think I see, so one client advertising TACK and one not? Right, that would work, assuming there are people going around doing it for every web site (the TACK police!). I can easily see that happening, it is just the kind of thing moxie would do, say. It still seems to me that it would be simpler if the client just didn't advertise the extension. I am probably missing something though.
hueving 13y ago
>This looks like a massive improvement, although I wonder if it actually protects clients which do not support the extension? Only indirectly through network effects. It's much harder for a valid attack certificate to stay undetected in the wild when a subset of the people you might attack are running TACK. You're right that it might not help clients if the MiTM software intelligently avoids attacking TACK-capable clients.

tptacek 13y ago

You could do that, but you'd be outed immediately by anyone who checked two TLS connections back-to-back for consistency.

xyzzy123 13y ago
I think I see, so one client advertising TACK and one not? Right, that would work, assuming there are people going around doing it for every web site (the TACK police!). I can easily see that happening, it is just the kind of thing moxie would do, say. It still seems to me that it would be simpler if the client just didn't advertise the extension. I am probably missing something though.

hueving 13y ago

>This looks like a massive improvement, although I wonder if it actually protects clients which do not support the extension? Only indirectly through network effects. It's much harder for a valid attack certificate to stay undetected in the wild when a subset of the people you might attack are running TACK. You're right that it might not help clients if the MiTM software intelligently avoids attacking TACK-capable clients.