Re: [HASMAT] HSTS Threat prevalence

"Steingruebl, Andy" <asteingruebl@paypal-inc.com> Fri, 06 August 2010 22:29 UTC

Return-Path: <asteingruebl@paypal-inc.com>
X-Original-To: hasmat@core3.amsl.com
Delivered-To: hasmat@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1BC703A69B3 for <hasmat@core3.amsl.com>; Fri, 6 Aug 2010 15:29:17 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.836
X-Spam-Level:
X-Spam-Status: No, score=-4.836 tagged_above=-999 required=5 tests=[AWL=0.281, BAYES_00=-2.599, DNS_FROM_RFC_BOGUSMX=1.482, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ncy3hiq80ih4 for <hasmat@core3.amsl.com>; Fri, 6 Aug 2010 15:29:15 -0700 (PDT)
Received: from den-mipot-002.corp.ebay.com (den-mipot-002.corp.ebay.com [216.113.175.153]) by core3.amsl.com (Postfix) with ESMTP id 9F7883A6948 for <hasmat@ietf.org>; Fri, 6 Aug 2010 15:29:15 -0700 (PDT)
DomainKey-Signature: s=ppinc; d=paypal-inc.com; c=nofws; q=dns; h=X-EBay-Corp:X-IronPort-AV:Received:Received:From:To:CC: Date:Subject:Thread-Topic:Thread-Index:Message-ID: References:In-Reply-To:Accept-Language:Content-Language: X-MS-Has-Attach:X-MS-TNEF-Correlator:acceptlanguage: Content-Type:Content-Transfer-Encoding:MIME-Version: X-CFilter; b=SMzN7ly2LYXWHv98eQmptf1qowZNS2D81Ixh+T+f2zcmRf/zYM7gCvUI Pn3fQ1i2+sjfJIsUG0Hu6vURxJwKMha2L+god1zUetxaAv3TbJMVeY601 ABhCj210Y/unmD8;
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=paypal-inc.com; i=asteingruebl@paypal-inc.com; q=dns/txt; s=ppinc; t=1281133787; x=1312669787; h=from:to:cc:date:subject:message-id:references: in-reply-to:content-transfer-encoding:mime-version; z=From:=20"Steingruebl,=20Andy"=20<asteingruebl@paypal-inc .com>|To:=20Devdatta=20Akhawe=20<dev.akhawe@gmail.com> |CC:=20Marsh=20Ray=20<marsh@extendedsubset.com>,=20IETF =20HASMAT=20list=20<hasmat@ietf.org>|Date:=20Fri,=206=20A ug=202010=2016:29:45=20-0600|Subject:=20RE:=20[HASMAT]=20 HSTS=20Threat=20prevalence|Message-ID:=20<5EE049BA3C65384 09BBE6F1760F328ABEAD832B54C@DEN-MEXMS-001.corp.ebay.com> |References:=20<AANLkTimt60chhpjL=3D3+ds8aGsBp18_YTAZU0GW s-jD4V@mail.gmail.com>=0D=0A=20=09<5EE049BA3C6538409BBE6F 1760F328ABEAD832B390@DEN-MEXMS-001.corp.ebay.com>=0D=0A =20=09<AANLkTinj7WcbyxPmpEfv0=3DntPTnuCCDiP9qD2iyvH_aw@ma il.gmail.com>=0D=0A=20=09<4C5C5F9D.3050107@extendedsubset .com>=0D=0A=20<AANLkTinKeRh9qZggt_fc1KyrUM-MU3izaD1sW-EBw e-b@mail.gmail.com>=0D=0A=20=09<5EE049BA3C6538409BBE6F176 0F328ABEAD832B53F@DEN-MEXMS-001.corp.ebay.com>=0D=0A=20<A ANLkTinXqY5QKTnvXj-eT-cdt+DB=3D+O4V1B++qdcdJiF@mail.gmail .com>|In-Reply-To:=20<AANLkTinXqY5QKTnvXj-eT-cdt+DB=3D+O4 V1B++qdcdJiF@mail.gmail.com>|Content-Transfer-Encoding: =20quoted-printable|MIME-Version:=201.0; bh=qgj4VWGJIoXUOTFcz7Cn/m32pGlp/iNB92/MZwvmbW8=; b=xZMfzIgmQeyLSPHepLY1t/h1DMxPOPTjBN/ENaBmMNKk3XS3W0d3rjM5 jF3CuQP3cCvcEwGlzSArh3dKlXZ4EOgx/pFd/nu/eCR8QJ7kyCDeIOTkR LUCuyfbVlNa4d+S;
X-EBay-Corp: Yes
X-IronPort-AV: E=Sophos;i="4.55,331,1278313200"; d="scan'208";a="71730455"
Received: from den-vtenf-002.corp.ebay.com (HELO DEN-MEXHT-001.corp.ebay.com) ([10.101.112.213]) by den-mipot-002.corp.ebay.com with ESMTP; 06 Aug 2010 15:29:47 -0700
Received: from DEN-MEXMS-001.corp.ebay.com ([192.101.150.21]) by DEN-MEXHT-001.corp.ebay.com ([10.241.17.52]) with mapi; Fri, 6 Aug 2010 16:29:46 -0600
From: "Steingruebl, Andy" <asteingruebl@paypal-inc.com>
To: Devdatta Akhawe <dev.akhawe@gmail.com>
Date: Fri, 6 Aug 2010 16:29:45 -0600
Thread-Topic: [HASMAT] HSTS Threat prevalence
Thread-Index: Acs1tpQYZ3gnXmz6SSiIBrbUafzibgAAD+Qw
Message-ID: <5EE049BA3C6538409BBE6F1760F328ABEAD832B54C@DEN-MEXMS-001.corp.ebay.com>
References: <AANLkTimt60chhpjL=3+ds8aGsBp18_YTAZU0GWs-jD4V@mail.gmail.com> <5EE049BA3C6538409BBE6F1760F328ABEAD832B390@DEN-MEXMS-001.corp.ebay.com> <AANLkTinj7WcbyxPmpEfv0=ntPTnuCCDiP9qD2iyvH_aw@mail.gmail.com> <4C5C5F9D.3050107@extendedsubset.com> <AANLkTinKeRh9qZggt_fc1KyrUM-MU3izaD1sW-EBwe-b@mail.gmail.com> <5EE049BA3C6538409BBE6F1760F328ABEAD832B53F@DEN-MEXMS-001.corp.ebay.com> <AANLkTinXqY5QKTnvXj-eT-cdt+DB=+O4V1B++qdcdJiF@mail.gmail.com>
In-Reply-To: <AANLkTinXqY5QKTnvXj-eT-cdt+DB=+O4V1B++qdcdJiF@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
acceptlanguage: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-CFilter: Scanned
Cc: IETF HASMAT list <hasmat@ietf.org>
Subject: Re: [HASMAT] HSTS Threat prevalence
X-BeenThere: hasmat@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: HTTP Application Security Minus Authentication and Transport <hasmat.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hasmat>, <mailto:hasmat-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hasmat>
List-Post: <mailto:hasmat@ietf.org>
List-Help: <mailto:hasmat-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hasmat>, <mailto:hasmat-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 06 Aug 2010 22:29:17 -0000

> -----Original Message-----
> From: Devdatta Akhawe [mailto:dev.akhawe@gmail.com]
> Sent: Friday, August 06, 2010 3:27 PM
> To: Steingruebl, Andy
> Cc: Marsh Ray; IETF HASMAT list
> Subject: Re: [HASMAT] HSTS Threat prevalence
> 
> > One easy approach we considered was thinking of likely places for these
> types of attacks, and seeing if w can detect them.  One easy example is
> airports. Look for wifi in an airport and you'll usually see quite a number of
> "free wifi" SSIDs, all with slightly carrying names.  Who knows which one is
> the real one.  I'd like to do a little experimenting on how many of those are
> rogue.
> >
> 
> I would add 'and are trying to do things which STS would have prevented'

Sorry, that was what I meant in this case by "rogue".