Re: [TLS] Captive portals, "access administratively disabled" and alert messages

Eric Rescorla <ekr@rtfm.com>于2018年1月3日周三 上午5:57写道：

> On Tue, Jan 2, 2018 at 1:40 PM, Mateusz Jończyk <mat.jonczyk@o2.pl> wrote:
>
>> CCing Ted Lemon <mellon at fugue.com> as the author of previous
>> proposition.
>>
>> W dniu 02.01.2018 o 21:20, Eric Rescorla pisze:
>> > On Tue, Jan 2, 2018 at 12:08 PM, Mateusz Jończyk <mat.jonczyk@o2.pl
>> > <mailto:mat.jonczyk@o2.pl>> wrote:
>> >
>> >     Then the browser should display a message inside the warning screen
>> that the
>> >     string cannot be trusted.
>> >
>> > Users tend to ignore that kind of warning.
>> Not any more then they ignore certificate warnings [2].
>
>
> That's not clear. We would be providing some sort of attacker-controlled
> text to the user with a warning that says "you can't trust this". That's
> difficult to pull off.
>
> Moreover, the certificate warnings are under control of the browser, but
> we actively work to discourage the user from ignoring them. Moreover, for
> HSTS sites, the browser doesn't allow the user to override them, so
> providing some attacker-controlled information would make the situation
> materially worse. And given that a lot of the sites which people are likely
> to hit with captive portals are in fact HSTS sites (because HSTS is common
> in big sites) instead showing attacker controlled information would make
> things materially worse.
>

providing some attacker-controlled information would make the situation
materially worse.  +1

Although some browsers support HSTS, but also offer a "user friendly"
configure item to ignore all ssl warnings.

> -Ekr
>
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>

-- 
致礼  Best Regards

潘蓝兰  Pan Lanlan