[websec] Question on Pinning Overrides

Jeffrey Walton <noloader@gmail.com> Tue, 14 October 2014 16:33 UTC

Return-Path: <noloader@gmail.com>
X-Original-To: websec@ietfa.amsl.com
Delivered-To: websec@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com []) by ietfa.amsl.com (Postfix) with ESMTP id D04C91A8A7A for <websec@ietfa.amsl.com>; Tue, 14 Oct 2014 09:33:44 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([]) by localhost (ietfa.amsl.com []) (amavisd-new, port 10024) with ESMTP id SsYrY053dW-e for <websec@ietfa.amsl.com>; Tue, 14 Oct 2014 09:33:43 -0700 (PDT)
Received: from mail-ig0-x236.google.com (mail-ig0-x236.google.com [IPv6:2607:f8b0:4001:c05::236]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5A5FC1A8A64 for <websec@ietf.org>; Tue, 14 Oct 2014 09:33:43 -0700 (PDT)
Received: by mail-ig0-f182.google.com with SMTP id hn15so15333502igb.9 for <websec@ietf.org>; Tue, 14 Oct 2014 09:33:42 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:reply-to:date:message-id:subject:from:to:content-type; bh=vL3rrWYnDpExi3m7pA7Od9D/iSN8HyH3yeH9FA90mDU=; b=WP7weEFHLDrSNE/RQpbE6D2KJ6CxYyi8fEr0b83l/c394Ie3OPWe+EmfSd6QKZsPld oZVD99H75Czp8ArC9V081Jbdug06Lwsw9C1e+dEZ7MeAhaXK7a4f6jIkl1hLZ80HUVLE zsILa/XH6Sfx/j6exulA0EQSyudX1kfv8uktLOBBimObD+0/B/I3YMArs1wPO3yvT7xW y5VcM75uxv5W50zfiveb0uejRfs4RePoyh2cnKiBjrpvR00NFyeD58KJG5PRMAVofPsp IMERfFCCr2hWOuA4IU2rWCRO/nx2+CDhaC3vbKUA74OZnW+VCgHZkcpbgset7be2hI/z izXw==
MIME-Version: 1.0
X-Received: by with SMTP id cv8mr6187002icb.22.1413304422656; Tue, 14 Oct 2014 09:33:42 -0700 (PDT)
Received: by with HTTP; Tue, 14 Oct 2014 09:33:42 -0700 (PDT)
Date: Tue, 14 Oct 2014 12:33:42 -0400
Message-ID: <CAH8yC8nM3D6DfDg5xb8hLnqnM+6Hz_iwpRF2UR8YEbuE+fntPA@mail.gmail.com>
From: Jeffrey Walton <noloader@gmail.com>
To: IETF WebSec WG <websec@ietf.org>
Content-Type: text/plain; charset="UTF-8"
Archived-At: http://mailarchive.ietf.org/arch/msg/websec/1JoI4ZcbjxcoThFf6g7yQhDt5dI
Subject: [websec] Question on Pinning Overrides
X-BeenThere: websec@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
Reply-To: noloader@gmail.com
List-Id: Web Application Security Minus Authentication and Transport <websec.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/websec>, <mailto:websec-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/websec/>
List-Post: <mailto:websec@ietf.org>
List-Help: <mailto:websec-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/websec>, <mailto:websec-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 14 Oct 2014 16:33:44 -0000

Section 2.7 states:

   UAs MAY choose to implement additional sources of pinning
   information, such as through built-in lists of pinning information.
   Such UAs should allow users to override such additional sources,
   including disabling them from consideration.

>From section 2.7, I understand a _user_ can provide an override to a
_preloaded_ pinset. But I don't see where a user is provided the
authority to override a non-preloaded pinset. And I don't see where an
external entity is provided authority to override a preloaded or
non-preloaded pinset.

Is this correct?

If correct, shouldn't the user be allowed to override both preloaded
and non-preloaded pinsets?

If correct, won't that break Chrome with respect to
http://www.imperialviolet.org/2011/05/04/pinning.html (see section
"What about MITM proxies, Fiddler etc?")?