Re: HSTS Fingerprinting.

"Martin Thomson" <mt@lowentropy.net> Thu, 10 October 2019 02:18 UTC

Return-Path: <ietf-http-wg-request+bounce-httpbisa-archive-bis2juki=lists.ie@listhub.w3.org>
X-Original-To: ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com
Delivered-To: ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5F55112006B for <ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com>; Wed, 9 Oct 2019 19:18:54 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.75
X-Spam-Level:
X-Spam-Status: No, score=-2.75 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.25, MAILING_LIST_MULTI=-1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=lowentropy.net header.b=sVqVVyH4; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=wNSBzd8c
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9MP1JxKaN8cT for <ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com>; Wed, 9 Oct 2019 19:18:52 -0700 (PDT)
Received: from frink.w3.org (frink.w3.org [IPv6:2603:400a:ffff:804:801e:34:0:38]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3C9DA120020 for <httpbisa-archive-bis2Juki@lists.ietf.org>; Wed, 9 Oct 2019 19:18:51 -0700 (PDT)
Received: from lists by frink.w3.org with local (Exim 4.89) (envelope-from <ietf-http-wg-request@listhub.w3.org>) id 1iINzk-00084j-6G for ietf-http-wg-dist@listhub.w3.org; Thu, 10 Oct 2019 02:16:00 +0000
Resent-Date: Thu, 10 Oct 2019 02:16:00 +0000
Resent-Message-Id: <E1iINzk-00084j-6G@frink.w3.org>
Received: from titan.w3.org ([2603:400a:ffff:804:801e:34:0:4c]) by frink.w3.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.89) (envelope-from <mt@lowentropy.net>) id 1iINzi-00083H-PT for ietf-http-wg@listhub.w3.org; Thu, 10 Oct 2019 02:15:58 +0000
Received: from wout4-smtp.messagingengine.com ([64.147.123.20]) by titan.w3.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from <mt@lowentropy.net>) id 1iINzg-00024B-Vr for ietf-http-wg@w3.org; Thu, 10 Oct 2019 02:15:58 +0000
Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailout.west.internal (Postfix) with ESMTP id 1B13142A for <ietf-http-wg@w3.org>; Wed, 9 Oct 2019 22:15:54 -0400 (EDT)
Received: from imap2 ([10.202.2.52]) by compute1.internal (MEProxy); Wed, 09 Oct 2019 22:15:54 -0400
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lowentropy.net; h=mime-version:message-id:in-reply-to:references:date:from:to :subject:content-type; s=fm3; bh=Y3EGRpnLbzAnygtgxpmYYZ11+vJtqwP D2Ur9mPNgQZk=; b=sVqVVyH4kntBF209tu57zooXdGVWbAjz98xnE2UdWRsKsjO qTUTCVMt+C3Lb7BAy6JVoZ+f6z/Am4ByUh0kC0DfvCQTf3fFkcaxB9M4j0wrBPeI 1EUEwCySReJW/zU6Hx3LTiMbUWl96Yk4bxbfaAn2ae9DoDNWofHl98irQV1tAl9f x5Cs6jqjeWRlBytpIVWUJlVPjCo60/M87gtQknrw0uGwBTZqKg24UyWuGVr12Bjn QGLtAwNw2LO0ymZlJZK1ludzPHN/BwBL/b3RyJD+tMRWqBvBBVFfuFyDqyKn/gdn YYre2kDAEywcw7WaO93qmbHSJS8Otg4Uo9S6YyA==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm1; bh=Y3EGRp nLbzAnygtgxpmYYZ11+vJtqwPD2Ur9mPNgQZk=; b=wNSBzd8c3/fjowVc0mZb1F zYCCDpIb9DIPXJbCLwZ6+/ON8fxCuU2Po0bg4YkUIpstXHbYZW+vYO6iTnwuweYy tIG36r02OlkgEHW6n/+xsA1RPKXLB+0IUVmZ0XfZWJvqzak7JAGSOrkyDt3X++mX 9LzCEXc2nq2BHaYon1nPL/Wh8go+QeJT7cJ5zStHItXGFNRKmixnZgbVc7tZFlwo keh9LrzqVsTD5p0JdFXGwgw9b5ff5skX7biev5LF5siKjSxWwqTt1hZwzSThGhdk xsPgB6PZbE0hx75yUBzs1cjyglo7N6oEZ2y0pfxdkjR9lanzrvKp/jBInhMfKiWg ==
X-ME-Sender: <xms:WZSeXWSif5sfnXiuXeodmxemZijawuYIhME-n7vrEmZblcFdBtYDbg>
X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedufedriedvgdehlecutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfghnecu uegrihhlohhuthemuceftddtnecunecujfgurhepofgfggfkjghffffhvffutgesthdtre dtreertdenucfhrhhomhepfdforghrthhinhcuvfhhohhmshhonhdfuceomhhtsehlohif vghnthhrohhphidrnhgvtheqnecuffhomhgrihhnpeifvggskhhithdrohhrghdpghhith hhuhgsrdgtohhmpdhmnhhothdrnhgvthenucfrrghrrghmpehmrghilhhfrhhomhepmhht sehlohifvghnthhrohhphidrnhgvthenucevlhhushhtvghrufhiiigvpedt
X-ME-Proxy: <xmx:WZSeXQDyku6oOaWfzN3PU0NKkG9HPwQDGIXMrK3_W93MkuPwOX_eug> <xmx:WZSeXe32p3PzwRS6mPGk5W9ruZAxRlgmPZHMHH-7I_HYhBA35I_idQ> <xmx:WZSeXWUa2F2kBjuvF96n38ooXE-tz5r1t9y7AnkIpmRpF6swFTpC8g> <xmx:WZSeXTKsx-71cBYJsQNOPUq_gNOGCl4cs3SJcJ_EgKZtOpPqcSCKlw>
Received: by mailuser.nyi.internal (Postfix, from userid 501) id 48955E00AF; Wed, 9 Oct 2019 22:15:53 -0400 (EDT)
X-Mailer: MessagingEngine.com Webmail Interface
User-Agent: Cyrus-JMAP/3.1.7-360-g7dda896-fmstable-20191004v2
Mime-Version: 1.0
Message-Id: <ee92700c-590a-4030-a326-07857059536d@www.fastmail.com>
In-Reply-To: <CAOt3QXtxbHCeuqS73XBZFQFbmZz-Q6k-tHDxpS9WODj7mw_1yA@mail.gmail.com>
References: <CAKXHy=eh2JzMdKUFFKataSfomfQUcNc4kVhiRbjevQogEspvYA@mail.gmail.com> <CAKXHy=cTSHvkt1Tj6imt2=2begaO-RXcioj-8xiu=zi0-KjU0g@mail.gmail.com> <CD8BFB37-ADF5-4DA7-8C6B-6D93B550CAD8@mnot.net> <CAKXHy=fTO8aaFvEe5XNT6pg28L_af2ukoxgzsjAipUgd9tgBgw@mail.gmail.com> <CAOt3QXtxbHCeuqS73XBZFQFbmZz-Q6k-tHDxpS9WODj7mw_1yA@mail.gmail.com>
Date: Thu, 10 Oct 2019 13:15:34 +1100
From: "Martin Thomson" <mt@lowentropy.net>
To: ietf-http-wg@w3.org
Content-Type: text/plain
Received-SPF: pass client-ip=64.147.123.20; envelope-from=mt@lowentropy.net; helo=wout4-smtp.messagingengine.com
X-W3C-Hub-Spam-Status: No, score=-5.8
X-W3C-Hub-Spam-Report: BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, W3C_AA=-1, W3C_DB=-1, W3C_WL=-1
X-W3C-Scan-Sig: titan.w3.org 1iINzg-00024B-Vr e51feba2eeb41b5bccf694464521a247
X-Original-To: ietf-http-wg@w3.org
Subject: Re: HSTS Fingerprinting.
Archived-At: <https://www.w3.org/mid/ee92700c-590a-4030-a326-07857059536d@www.fastmail.com>
Resent-From: ietf-http-wg@w3.org
X-Mailing-List: <ietf-http-wg@w3.org> archive/latest/37044
X-Loop: ietf-http-wg@w3.org
Resent-Sender: ietf-http-wg-request@w3.org
Precedence: list
List-Id: <ietf-http-wg.w3.org>
List-Help: <https://www.w3.org/Mail/>
List-Post: <mailto:ietf-http-wg@w3.org>
List-Unsubscribe: <mailto:ietf-http-wg-request@w3.org?subject=unsubscribe>

This isn't consensus, but I agree with draft-roach-bis-documents on this subject.  A wholesale replacement can just fix the bits that need fixing.  We do our readership a disservice every time we ship a monkey-patch specification.

On Tue, Oct 8, 2019, at 10:46, Jeff Hodges wrote:
> [ just us ]
> 
> ah, ok, something to chat about on Wed -- ie, are you thinking a 
> monkey-patch of rfc6797 or an entire updated spec, or ...?
> 
> 
> 
> On Mon, Oct 7, 2019 at 4:48 AM Mike West <mkwst@google.com> wrote:
> > Ok, thanks Mark. I'll aim to have an ID up by whenever the Singapore cutoff turns out to be.
> > 
> > -mike
> > 
> > 
> > On Thu, Oct 3, 2019 at 7:59 AM Mark Nottingham <mnot@mnot.net> wrote:
> >> Hey Mike,
> >> 
> >>  I wouldn't treat the silence as indicative of disinterest.
> >> 
> >>  Would you be willing to write up a short draft explaining your proposal and submit it for discussion in Singapore (presenting remotely if necessary)? Even if you decide not to do it here, I suspect you'll be able to reuse the markdown...
> >> 
> >>  Cheers,
> >> 
> >> 
> >>  > On 1 Oct 2019, at 11:47 pm, Mike West <mkwst@google.com> wrote:
> >>  > 
> >>  > Ping!
> >>  > 
> >>  > If this group doesn't feel any particular ownership, I'm happy to try to define some web browsery behavior in W3C/WHATWG. If y'all would prefer an RFC6797bis, great!
> >>  > 
> >>  > -mike
> >>  > 
> >>  > 
> >>  > On Wed, Sep 18, 2019 at 3:10 AM Mike West <mkwst@google.com> wrote:
> >>  > A year or two ago, +John Wilander and others at Apple proposed some changes to HSTS in https://webkit.org/blog/8146/protecting-against-hsts-abuse/ that went some way towards mitigating the abuses documented in Section 14.9 of RFC6797. Given some shifts in the way we're thinking about some other concepts, I've written up a short proposal at https://github.com/mikewest/strict-navigation-security that builds upon and simplifies Apple's proposal. We discussed it briefly at yesterday's webappsec meeting, and there seems to be interest in doing something in this space.
> >>  > 
> >>  > +Mark Nottingham and +Jeff Hodges suggested that I loop this group into that conversation, as the original websec group has disbanded. Is it a topic this group would like to pick up? If not, would y'all be comfortable with us defining some web browser behavior/Fetch integration in webappsec that constrains the existing RFC?
> >>  > 
> >>  > Thanks!
> >>  > 
> >>  > -mike
> >> 
> >>  --
> >>  Mark Nottingham https://www.mnot.net/
> >> 
> 
> 
> -- 
> Thanks, HTH,
> 
> =JeffH