IETF Logo Mail Archive

Re: [websec] New draft of HTTP header-based public key pinning

"Steingruebl, Andy" <asteingruebl@paypal-inc.com> Wed, 09 November 2011 16:38 UTC

Return-Path: <asteingruebl@paypal-inc.com>
X-Original-To: websec@ietfa.amsl.com
Delivered-To: websec@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3DC0C21F8A7E for <websec@ietfa.amsl.com>; Wed, 9 Nov 2011 08:38:19 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -9.117
X-Spam-Level:
X-Spam-Status: No, score=-9.117 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, DNS_FROM_RFC_BOGUSMX=1.482, RCVD_IN_DNSWL_HI=-8]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6hRoKdSfgMEK for <websec@ietfa.amsl.com>; Wed, 9 Nov 2011 08:38:15 -0800 (PST)
Received: from den-mipot-001.corp.ebay.com (den-mipot-001.corp.ebay.com [216.113.175.152]) by ietfa.amsl.com (Postfix) with ESMTP id 1570C21F8ADC for <websec@ietf.org>; Wed, 9 Nov 2011 08:38:15 -0800 (PST)
DomainKey-Signature: s=ppinc; d=paypal-inc.com; c=nofws; q=dns; h=X-EBay-Corp:X-IronPort-AV:Received:Received:From:To:CC: Date:Subject:Thread-Topic:Thread-Index:Message-ID: References:In-Reply-To:Accept-Language:Content-Language: X-MS-Has-Attach:X-MS-TNEF-Correlator:acceptlanguage: x-ems-proccessed:x-ems-stamp:Content-Type: Content-Transfer-Encoding:MIME-Version:X-CFilter; b=RbcC+f9ZktUtZsaLEI0mlyKwTvqOM/rBhLOBXDJHV0xOtK6cX458EuLM JtcXosRPI94HQIc/hLIR1S3+bulE3ryYxJ9Gnd4JFugLSlAOqRzb5Ym0U 8ZuE2NPkR5Qt0gU;
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=paypal-inc.com; i=asteingruebl@paypal-inc.com; q=dns/txt; s=ppinc; t=1320856695; x=1352392695; h=from:to:cc:date:subject:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=E84OurJE/o7CZ5mkHN/x6vQhcUn7b3OPhzMkMNAEOWg=; b=NgUXA5gNT2nKgMIHHe6mmfmIJcW7CvW2eoyHVG6W50Fem4caF9ZWLVbz dV2HhLqgjDVMcJt2Rf0601VGADZ+RkhjBkQDPDJi4JrG9kTVGAuPwVcRO WArJfAa4u+nLsNV;
X-EBay-Corp: Yes
X-IronPort-AV: E=Sophos;i="4.69,484,1315206000"; d="scan'208";a="4105835"
Received: from den-vtenf-001.corp.ebay.com (HELO DEN-MEXHT-003.corp.ebay.com) ([10.101.112.212]) by den-mipot-001.corp.ebay.com with ESMTP; 09 Nov 2011 08:38:15 -0800
Received: from DEN-MEXMS-001.corp.ebay.com ([192.101.150.21]) by DEN-MEXHT-003.corp.ebay.com ([10.241.17.54]) with mapi; Wed, 9 Nov 2011 09:38:14 -0700
From: "Steingruebl, Andy" <asteingruebl@paypal-inc.com>
To: Adam Barth <ietf@adambarth.com>
Date: Wed, 09 Nov 2011 09:38:13 -0700
Thread-Topic: [websec] New draft of HTTP header-based public key pinning
Thread-Index: AcyewQpRTroclxM/R2ip3xP77iZtBQAPMB6w
Message-ID: <5EE049BA3C6538409BBE6F1760F328ABEBED718198@DEN-MEXMS-001.corp.ebay.com>
References: <CAOuvq21Ne0CWT3Dzn0sutGDBg0K+efZhxmqBZiLuxbO2OwxnFg@mail.gmail.com> <CA+cU71kFFpuooyiBTarvLT3VJigZhW0BgpQi1gMTn7zB=sFh+w@mail.gmail.com> <CAOuvq20uCZsp80yJ6gjeh-AGVswu3GTPuSYYCGyXPWpO-RJpsA@mail.gmail.com> <5EE049BA3C6538409BBE6F1760F328ABEBED718018@DEN-MEXMS-001.corp.ebay.com> <CAJE5ia9Ryjus6Zy38PFffCnGsZHw+byvdTVCi7XmYWUd8rVdTQ@mail.gmail.com>
In-Reply-To: <CAJE5ia9Ryjus6Zy38PFffCnGsZHw+byvdTVCi7XmYWUd8rVdTQ@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
acceptlanguage: en-US
x-ems-proccessed: 10SqDH0iR7ekR7SRpKqm5A==
x-ems-stamp: u6bst9XfLv/9kO+SEhES+g==
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-CFilter: Scanned
Cc: Chris Evans <cevans@google.com>, IETF WebSec WG <websec@ietf.org>, Ian Fette <ifette@google.com>, Wan-Teh Chang <wtc@google.com>
Subject: Re: [websec] New draft of HTTP header-based public key pinning
X-BeenThere: websec@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Web Application Security Minus Authentication and Transport <websec.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/websec>, <mailto:websec-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/websec>
List-Post: <mailto:websec@ietf.org>
List-Help: <mailto:websec-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/websec>, <mailto:websec-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 09 Nov 2011 16:38:19 -0000

> -----Original Message-----
> From: Adam Barth [mailto:ietf@adambarth.com]


> > We battled this problem with HSTS as well.  I think what Mozilla settled on
> (and I don't remember the Chrome solution) is to use a different storage
> mechanism when HSTS is *set* during private browsing mode, and clear on
> exit from private browsing.
> 
> It's been a while since I wrote that code, but I'm pretty sure that's how it
> works in Chrome too.  There's a separate memory-only HSTS store that's
> used for incognito.  That's consistent with how we handle other host-specific
> data stored by the network layer, such as cookies.

Is this documented anywhere?  Where should it be?  Maybe add a section to the browser security handbook, if nowhere else, so at least we all have it written down what the browsers have implemented?

And, since we decided these specifics don't belong in the IETF  HSTS spec, where could we document them for real?

- Andy

v2.23.0 | Report a Bug | By Email