Re: [websec] Consensus call: Issue #57 (max-max-age)

[Yoav Nir <[e-mail]>]

Hi

Just trying to get us close to consensus. Still no hats. There are two arguments for limiting max-age:

1. With unlimited max-age, it's possible for the legitimate site owner to by mistake damage their sites. You could pin the CA certificate, and lock yourself in to that CA for all eternity. You could pin a current and future EE public keys, and then when the current public key expires, you might not use the future one because you mistyped it (or your CA no longer accepts 1024-bit keys). For whatever reason, a bad choice you make while trying out HPKP either bricks your site or constrains your behavior for a while.

2. With unlimited max-age, a current owner of a domain name can set a pin that a future owner cannot honor. So if Mr. diaper consultant[1] ever decides to retire, he could set a long-lived pin such that I would not be able to use the domain even if I buy it. A variation on this is the case where an attacker like ComodoHacker manages to MitM a popular site, and he sets a long-lived pin that prevents users from accessing the site not through the MitM. This means that browser support for HPKP could serve to amplify attacks that are plenty bad enough as they are.

Regarding #1 I'm not convinced. HPKP (much like HSTS) is already a pretty big gun with which users can shoot themselves in the foot. A website that's important for its owner (whether it's social networking, political action, or business) cannot afford to be inaccessible for any length of time. A month is no less a disaster than a year. As for constraining your behavior, this merits deployment advice, not limiting the usefulness of the protocol for other sites.

#2 is more worrying. I think the previous owner issue would be served even with a 1 year hard limit, and I don't think anyone here is arguing that a 1-year limit is too short. But the attack amplification is a real thing, and it works against sites that haven't even implemented HPKP. Sites that deploy HPKP are protected from a MitM such as ComodoHacker (or his "friends"). But having HPKP in the browser (but not in the website) allows his friends to lock out browsers by inserting a pin. So if browsers implement this, it amplifies attacks against the general population of SSL-protected web sites. I'm not sure whether in the grand scheme of things this makes the Internet better or worse.

Note, though, that this issue exists even if max-age is limited. Bricking the site for a month (for some users in Iran) is a bad enough outcome, only slightly mitigated by it being only for a month.

I started out writing this message thinking it was going to have a proposal that we could all reach consensus about. I'm not sure I got there. I guess if this was a vote, I would vote for a year-long max-max-age, but I'm not really as sure about this as I was when I started writing this message.

Yoav

[1] http://www.yoavnir.com