Re: [websec] Decouple HSTS's two orthogonal effects?

What design principle is this ?

Seems to me that a design principle should be `don't mix orthogonal
design goals'. If a single goal has multiple effects, so be it. The
design goal is ensuring that interaction with website is not
vulnerable to MITM attacks. Since users click through cert warnings,
showing warnings is not enough (hence the effect 2). And because of
the way the web platform is designed, just switching half-way to SSL
doesn't really buy much security, hence effect 1. But the design goal
is just 1.

If the use cases you mentioned are compelling, then they should be
handled via a separate mechanism. I personally don't find them too
compelling. For Tom's intranet example, (or imagine a large
enterprise), the right thing might be to just add the cert issuer to
the browser CA store.

=devdatta

On 23 March 2011 21:22, Tom Ritter <tom@ritter.vg> wrote:
> I'm new to this list, so apologies if this has been discussed - but I
> was surprised and dismayed when I learned of the coupling of these two
> effects.  A very common situation I find myself in is adding an
> exception for a self-signed certificate or otherwise untrusted
> certificate, either for a personal machine, development machines, or
> intranet machines.  The individual cert is verified by fingerprint
> using out-of-band channels, added, and doesn't change for a while -
> and we'd like to use HSTS on these boxes.  But based off my simple
> testing in Chrome - coupling these effects prevents this workflow.
>
> -tom
> _______________________________________________
> websec mailing list
> websec@ietf.org
> https://www.ietf.org/mailman/listinfo/websec
>