Re: [websec] draft-ietf-websec-key-pinning

[Ryan Sleevi <[e-mail]>]

On Tue, Aug 26, 2014 at 2:06 PM, Tom Ritter <[e-mail]> wrote:

> On 26 August 2014 15:51, Chris Palmer <[e-mail]> wrote:
> >> Requiring PKP-RO to be on every load would allow an attacker
> >> to strip the header on the connections they MITM.
> >
> > Only if The Alice Foundation did not also use a regular PKP header.
>
> Correct.
>
> >> Letting it be cached
> >> allows an organization to put a max-age of 45 days on it, without the
> >> risk of bricking their site if they aren't administratively competent.
> >>
> >> Obviously an attacker can also block the reports from being sent, but
> >> I'm hoping that the clause "In any case of report failure, the UA MAY
> >> attempt to re-send the report later" will be considered in this case,
> >> and that UAs will make an attempt at getting potentially blocked
> >> reports out at a later date.
> >
> > Yeah, sort of. But don't think of PKP-RO as a defense against attacks,
> > even if it might sometimes have that secondary benefit. It is
> > primarily a debugging aid for The Alice Foundation and BobCorp to get
> > PKP working. ("What all Trents do we need to trust, anyway?")
>
> I'm not going to put words in your mouth, because different authors
> have different opinions about things, but I will quote from another:
>
> > Ryan Sleevi wrote (
> http://lists.w3.org/Archives/Public/public-webcrypto-comments/2013Feb/0001.html
> )
> >> I wrote:
> >> 1. A large site that is commonly proxies by corporate and malicious
> >> actors wishes to monitor how common this is done.  They place
> >> javascript bindings in their code to view the user's certificate and
> >> report the observed value.
> >> Note this use case has already been performed by Facebook, who had to
> >> resort to Flash to do so, because javascript did not provide the
> >> functionality.
> >
> >Use report-uri with HPKP, in report-only mode
>
> I don't consider PKP-RO as a defense, but as an attempt at detection
> of attacks, with no risk of breaking your site.  It is extraordinarily
> useful to be notified of attacks against your users, even if they are
> not prevented. They help you understand where you should invest time
> and money.
>

To be clear, I absolutely agree with Chris. You cannot and should not be
seeing PKP-RO as a security mechanism.

Contextually, this also lacks the significant discussion of enterprise
policy and the like. As noted in the spec, UAs MAY disable Pin Validation
according to policy - such as locally trusted authorities, such as
corporate proxies or malicious actors.


>
> The foot-gun potential is very high with HPKP, we all know that.  It's
> high enough to the point that many organizations, who have someone
> maintaining a website part time (or outsource it) may forgoe PKP
> entirely because it makes them nervous - but they would be happy to
> deploy a no-risk PKP-RO.  But the benefit of doing so if it is not
> being cached is extraordinarily low, to the point it's probably not
> worth doing.
>
> -tom
>