Re: HSTS preload flaw

Austin William Wright <> Mon, 10 February 2020 06:33 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 4E599120098 for <>; Sun, 9 Feb 2020 22:33:06 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.749
X-Spam-Status: No, score=-2.749 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.25, HTML_MESSAGE=0.001, MAILING_LIST_MULTI=-1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (1024-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id MPQ0lIf8OHPI for <>; Sun, 9 Feb 2020 22:33:04 -0800 (PST)
Received: from ( []) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 32EFD120077 for <>; Sun, 9 Feb 2020 22:33:03 -0800 (PST)
Received: from lists by with local (Exim 4.92) (envelope-from <>) id 1j12Yx-0004Xj-8N for; Mon, 10 Feb 2020 06:28:55 +0000
Resent-Date: Mon, 10 Feb 2020 06:28:55 +0000
Resent-Message-Id: <>
Received: from ([]) by with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from <>) id 1j12Yq-0004Ws-05 for; Mon, 10 Feb 2020 06:28:48 +0000
Received: from ([2607:f8b0:4864:20::533]) by with esmtps (TLS1.3:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.92) (envelope-from <>) id 1j12Yo-0005nk-6Z for; Mon, 10 Feb 2020 06:28:47 +0000
Received: by with SMTP id z12so3355749pgl.4 for <>; Sun, 09 Feb 2020 22:28:45 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=google; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=Z0VPllhsWDZ4JJZZNTLVrlZ9vVkmcEMocQDwVuNrXcw=; b=bvFm0yP+h3WQiw+RNoMBrIVzCbf+cHrNlbbdcAbxt26kVPvAedZo7BV0/lPXCevSWh AhNbaVWe4Yd6x4VM5cME5zqf1/wtcddbQpulbGYvEQ5yFEOnwuU1P4rGd4o8Un3fMLTk s4AUcGIbrug2O7g9wp97XMG4NhRgcZn4Db7qU=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=Z0VPllhsWDZ4JJZZNTLVrlZ9vVkmcEMocQDwVuNrXcw=; b=XA4+ukXqZ1HR9RUiynKjbUI1sMw3p1GP5Vv7lYYpxURqhl7tapgj99BwA9BqTRJr1a HpS4zevDsSOnRhj7+chue1ry5pcD8XNb0Lc01zx0yFBjFu2bIHlxwqVC0vkQeTp+6+Ib NKP29VK6rvHw9IEVGTF+U3aKhnzYbflFLASA6qj5THz2sfsNx3yNNF15kvDFAmAY8bp9 JPINxuvjsewO+ToHJMVjR+4zZCirFhL5OQ8gXwfSHLwMJhHqjYwHYs1+jhrGP4+8NhbO iyolB43xOLWGGzIgzi163SvIdgVGUeLRonZb6/wsq5KfViAgkOrQxW75wA9V/NUN7XQG r3FA==
X-Gm-Message-State: APjAAAWwFTZswPB7VbyzMaBlWIXsAmJ+mgzn8W5bgJ00MH6oacq3f7IU XtnqxFr9G1P1rGerBE4AJ5dGQg==
X-Google-Smtp-Source: APXvYqzXwbZdlf+76MOXBEWiULruKXPnrS6JjfDU+e6jNzTh+S7F27If1MDFVFbiFbalMr7mJNr0Ag==
X-Received: by 2002:a63:1d1a:: with SMTP id d26mr75644pgd.98.1581316124203; Sun, 09 Feb 2020 22:28:44 -0800 (PST)
Received: from [] ( []) by with ESMTPSA id l21sm11079613pgo.33.2020. (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sun, 09 Feb 2020 22:28:43 -0800 (PST)
From: Austin William Wright <>
Message-Id: <>
Content-Type: multipart/alternative; boundary="Apple-Mail=_A9B808CB-2AE5-4F05-AADD-EE119C7D069C"
Mime-Version: 1.0 (Mac OS X Mail 13.0 \(3608.\))
Date: Sun, 09 Feb 2020 23:28:42 -0700
In-Reply-To: <>
Cc: Rob Sayre <>, " Group" <>
To: Eric Mill <>
References: <> <> <> <> <>
X-Mailer: Apple Mail (2.3608.
Received-SPF: pass client-ip=2607:f8b0:4864:20::533;;
X-W3C-Hub-Spam-Status: No, score=-6.1
X-W3C-Hub-Spam-Report: BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, W3C_AA=-1, W3C_DB=-1, W3C_IRA=-1, W3C_WL=-1
X-W3C-Scan-Sig: 1j12Yo-0005nk-6Z b1f27e39d539c4897023fe7768e060d8
Subject: Re: HSTS preload flaw
Archived-At: <>
X-Mailing-List: <> archive/latest/37348
Precedence: list
List-Id: <>
List-Help: <>
List-Post: <>
List-Unsubscribe: <>

On Feb 9, 2020, at 20:19, Eric Mill <> wrote:
> On Sun, Feb 9, 2020 at 6:51 PM Austin Wright < <>> wrote:
> If encrypted connections are important to you as a server operator, it seems the only foolproof way to avoid plaintext communication is don’t listen on port 80.
> Without getting into the overall issue, I just want to note for readers of the thread - server operators can't avoid plaintext communication by clients by not listening on port 80. Clients can attempt to initiate a connection to a hostname over port 80 whether or not the "real" server is listening on port 80, and that connection can be interfered with by a malicious network actor. That's why HSTS exists - to provide some kind of signal to the client that they should never bother even trying to make that connection.

This is correct, thanks for the correction. I should have noted this. Also, note how HSTS applies to all connections to a hostname, regardless of port number.

In an active (MITM) attack, the server operator doesn’t even have to be online, of course; the attacker will receive all connections to the intended host.

My comment is with regards to passive attacks where a server operator wants to avoid inadvertently accepting plaintext data: A Permanent Redirect would still allow the headers to be sent to the server (and the request body, if the client doesn’t follow 100-continue).

It seems to me if an attacker can get a victim to compose a sensitive request, but direct that request to an attacker-controlled scheme and port, why not an attacker-controlled host too, or any host not on an HSTS Preload list?