IETF Logo Mail Archive

Re: HSTS Misuse

Dennis Olvany <dennisolvany@gmail.com> Sun, 22 May 2016 14:18 UTC

Return-Path: <ietf-http-wg-request+bounce-httpbisa-archive-bis2juki=lists.ie@listhub.w3.org>
X-Original-To: ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com
Delivered-To: ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A76E112D095 for <ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com>; Sun, 22 May 2016 07:18:44 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -8.446
X-Spam-Level:
X-Spam-Status: No, score=-8.446 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-1.426, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id D9jfjaauvcfv for <ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com>; Sun, 22 May 2016 07:18:43 -0700 (PDT)
Received: from frink.w3.org (frink.w3.org [128.30.52.56]) (using TLSv1.2 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3BC0B12B004 for <httpbisa-archive-bis2Juki@lists.ietf.org>; Sun, 22 May 2016 07:18:43 -0700 (PDT)
Received: from lists by frink.w3.org with local (Exim 4.80) (envelope-from <ietf-http-wg-request@listhub.w3.org>) id 1b4U94-000561-D7 for ietf-http-wg-dist@listhub.w3.org; Sun, 22 May 2016 14:14:18 +0000
Resent-Date: Sun, 22 May 2016 14:14:18 +0000
Resent-Message-Id: <E1b4U94-000561-D7@frink.w3.org>
Received: from maggie.w3.org ([128.30.52.39]) by frink.w3.org with esmtps (TLS1.2:DHE_RSA_AES_128_CBC_SHA1:128) (Exim 4.80) (envelope-from <dennisolvany@gmail.com>) id 1b4U8z-00054c-4M for ietf-http-wg@listhub.w3.org; Sun, 22 May 2016 14:14:13 +0000
Received: from mail-vk0-f45.google.com ([209.85.213.45]) by maggie.w3.org with esmtps (TLS1.2:RSA_ARCFOUR_SHA1:128) (Exim 4.80) (envelope-from <dennisolvany@gmail.com>) id 1b4U8x-0001QX-QY for ietf-http-wg@w3.org; Sun, 22 May 2016 14:14:12 +0000
Received: by mail-vk0-f45.google.com with SMTP id f66so195145562vkh.2 for <ietf-http-wg@w3.org>; Sun, 22 May 2016 07:13:50 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=Vpjs/Yu8Fq88b8UDB893mKNermgCG2rueqCsUbNfex4=; b=SVFiRC+2rFV59hWsMGJjNRunMlZRgRujA7nzZJ4G9EXUwZycbNR6towTyP0z3wcGZb f40JA4nl3zKiFqV5+noAU+17AOjCoKJy8AamT+eDSCTcfOGuM1Zxk/Mh7yVS7W5Mh+Jk 0THaOz5P0h+YP6Qhqfc+bFjahzBb3uU7K8k7GDYErjF7K4QIEjoH8lo8XnxYJSeZAdIY 2oUH5xnniF0TcUNgsmC0njHFF375lvgqdvTNfR7pYpl2xlBPhq2i/xjKDN4s7fYu130U j5E9u73ENlU54b04O5jtR1XQXImhr9dNtCrRFejfxjo/USPeJy09+YCoIKOSAq4EVP8G gQ6w==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=Vpjs/Yu8Fq88b8UDB893mKNermgCG2rueqCsUbNfex4=; b=Q5HDA6Re9a+i2I9toW4UWeKwa960pAFUSqAm7t4YyUGEToK9RfH/n1pfnWYzPh/OGk HH2GSpXAAmnB0J/vcXkWPUrRtwlaMbOHbOvEQZ5yR/c9WvTQnegAn4xg3YVwDhIXMlbQ v165ZoQXVPa/fMqDvZD75NRZ8habeklgg5q7Zn6GWeeuH0fRK7KMAz6lkGHlMwyCC3GX gyYLzBqLJlU0plMGhGIShVVNHPI7yUan3KBj2svPQ72pfGk/wqRTvMLJQhamu9uKaNxL w13iDou1htYe2jaSkYjcXsSAU3TEwwtDkPQg1+3VvjViDcwM/JJsnqFEt5ClRmNFiaRw +0Tg==
X-Gm-Message-State: AOPr4FUfKNldtq2w4G2l4C96sYDI9fAHmXe5tkYfaz7jGSJeuuUxyskdxn927laLw2Psdw3MCLU/Uu55R2jpHw==
X-Received: by 10.176.3.85 with SMTP id 79mr6967605uat.142.1463926424960; Sun, 22 May 2016 07:13:44 -0700 (PDT)
MIME-Version: 1.0
References: <CAATNdDzB=Dgtqmyj5mB_VE24kvi9Nqt-6f2tdL0fJsZS0HypNQ@mail.gmail.com> <CACHSkNpx31zci8Kxv7LS85OJoJfuzC-hZx1RMzoiQ9-v4S=ObQ@mail.gmail.com>
In-Reply-To: <CACHSkNpx31zci8Kxv7LS85OJoJfuzC-hZx1RMzoiQ9-v4S=ObQ@mail.gmail.com>
From: Dennis Olvany <dennisolvany@gmail.com>
Date: Sun, 22 May 2016 14:13:35 +0000
Message-ID: <CAATNdDwUpXAvpZp-=L-mif2zDSkMjA6VtKv_hrCQZJQBmt0Ctg@mail.gmail.com>
To: Philipp Junghannß <teamhydro55555@gmail.com>
Cc: HTTP Working Group <ietf-http-wg@w3.org>
Content-Type: multipart/alternative; boundary="001a113d152c898a0705336eee6c"
Received-SPF: pass client-ip=209.85.213.45; envelope-from=dennisolvany@gmail.com; helo=mail-vk0-f45.google.com
X-W3C-Hub-Spam-Status: No, score=-5.5
X-W3C-Hub-Spam-Report: AWL=-0.815, BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, W3C_AA=-1, W3C_WL=-1
X-W3C-Scan-Sig: maggie.w3.org 1b4U8x-0001QX-QY b1a3390ff3d6863fb4fd170952ffacc2
X-Original-To: ietf-http-wg@w3.org
Subject: Re: HSTS Misuse
Archived-At: <http://www.w3.org/mid/CAATNdDwUpXAvpZp-=L-mif2zDSkMjA6VtKv_hrCQZJQBmt0Ctg@mail.gmail.com>
Resent-From: ietf-http-wg@w3.org
X-Mailing-List: <ietf-http-wg@w3.org> archive/latest/31654
X-Loop: ietf-http-wg@w3.org
Resent-Sender: ietf-http-wg-request@w3.org
Precedence: list
List-Id: <ietf-http-wg.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Post: <mailto:ietf-http-wg@w3.org>
List-Unsubscribe: <mailto:ietf-http-wg-request@w3.org?subject=unsubscribe>

I suppose third-party HSTS may be a good way to describe the scenario I
propose. To be more clear, let's say that the https server is provided by a
web hosting company and their customer is the domain owner.
On Sun, May 22, 2016 at 10:03 AM Philipp Junghannß <teamhydro55555@gmail.com>
wrote:

> Talking about hsts misuse we should not forget the so-called hsts
> supercookies, which obviously makes no sense from a technical perspective
> but the point that hsts can be used for tracking still stands.
> What to do about that?
>
> Unlike cookies, hsts cannot be easily purged by the user.
> Am 22.05.2016 15:51 schrieb "Dennis Olvany" <dennisolvany@gmail.com>:
>
>> There is a section in the RFC that addresses DoS, but I am interested in
>> a particular case. Let's posit that a domain owner directs their domain to
>> an https server that returns an HSTS header without the domain owner's
>> knowledge or consent. If the domain owner then directs their domain to an
>> http server, the site will be unreachable from browsers that are caching
>> HSTS. Has there been any discussion or guidance regarding this scenario?
>> When is the implementation of HSTS considered to be inappropriate?
>>
>

v2.23.0 | Report a Bug | By Email