Re: [websec] #57: Re-add an upper limit to max-age

Ryan Sleevi <> Fri, 29 March 2013 21:15 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 4805A21E804D for <>; Fri, 29 Mar 2013 14:15:36 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -101.978
X-Spam-Status: No, score=-101.978 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id ZUgNaHn9in6x for <>; Fri, 29 Mar 2013 14:15:31 -0700 (PDT)
Received: from ( [IPv6:2607:f8b0:4001:c03::230]) by (Postfix) with ESMTP id 2B55821E804E for <>; Fri, 29 Mar 2013 14:15:24 -0700 (PDT)
Received: by with SMTP id x14so931007ief.21 for <>; Fri, 29 Mar 2013 14:15:23 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20120113; h=mime-version:x-received:in-reply-to:references:date:message-id :subject:from:to:cc:content-type:content-transfer-encoding; bh=d1PBt4TCgMUHpGPAgVF3qhNY5OmS1uD9n2jgD+w8Zg0=; b=I/CWcNNqTkoA/57NvWZZCipdgkjUkHbW3oXMr9WMcGpUh4XKs0BwFdG849e/qha7JY tIBrlNSLb+G4xFTQ1H95IHbdDS8mu7RtygABqzGumMMU7dtBAUGzJ/80NPRr4zqEX3SB 5aSQjisQ9RAZrYtMOfpO1OzONalizclpwu5G5D2ITlzU+LEX20CqbQ+iDYxC3piGRf3/ gQOR6+x4TFCGIcVlDAacv0TKiFd3qznT8SI+AbjPlMfzogPPLNNUSobPKCTS2H5lgYae UGcSmkIGdVz5M2/ugT8yz5FMJlEelwNxYJOuwUpo/FekKlnJfGvliX39i3fSEwlUPSuA MasA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20120113; h=mime-version:x-received:in-reply-to:references:date:message-id :subject:from:to:cc:content-type:content-transfer-encoding :x-gm-message-state; bh=d1PBt4TCgMUHpGPAgVF3qhNY5OmS1uD9n2jgD+w8Zg0=; b=N2Vh4xPxJBFy5IkiLTNe5Ji8SvWdZtJhET5/c1fzTXRorBgxDXqLzVfh5Y/jGfOKCV Pl+akmFu4QCi0j3y/eXqeNoiF0/WYuW6iDgULCsKFwVD+NP2fu+dVb0Os9qL3xNKRRvK j2ItvSzklXSD3HSIBYTeB8TMPfccnWgpIsRnmFyVMT/+TFyEQLfvE1o+0ZTYfLY92WrQ vxDZbafVfiF2pvnx7ZjYQ3mIYbrLGQPE2+ssxZPQCyI0wY4hUmgB4xkjyD5WmriVsMO+ bD/aMZJoWFRGIh1H2fvf3I1Q/lmYymHyvlLSAfHcEu+xodjv6Oe37BKEyW8hp1sh6KsD +4hA==
MIME-Version: 1.0
X-Received: by with SMTP id j16mr84558igc.73.1364591723793; Fri, 29 Mar 2013 14:15:23 -0700 (PDT)
Received: by with HTTP; Fri, 29 Mar 2013 14:15:23 -0700 (PDT)
In-Reply-To: <>
References: <> <> <> <> <> <> <> <> <>
Date: Fri, 29 Mar 2013 14:15:23 -0700
Message-ID: <>
From: Ryan Sleevi <>
To: Joseph Bonneau <>
Content-Type: text/plain; charset="windows-1252"
Content-Transfer-Encoding: quoted-printable
X-Gm-Message-State: ALoCoQl8SifmoVKXWkP7LQAha8TBFSLGz0TeP6Yx1eP/8iDTRlhwkLMS6CmQjSajSclaryhS/KQwhdkH/opoOdaK78j4iDUr0xoPDSJQyQrVrwxm3DKd0pbtAfE7nAdATuoWxNvs9rkr+YZXmh53TzlciKjnZW6LnqZKqE0oUf7qDAXazCvBNDsVHQAeeZTtJ9dfWnpYhU+x
X-Mailman-Approved-At: Fri, 29 Mar 2013 19:39:39 -0700
Cc: "<>" <>, websec issue tracker <>
Subject: Re: [websec] #57: Re-add an upper limit to max-age
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Web Application Security Minus Authentication and Transport <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Fri, 29 Mar 2013 21:15:36 -0000

On Fri, Mar 29, 2013 at 10:45 AM, Joseph Bonneau <> wrote:
>> Hopefully, it's not just Google that implements this. I guess any browser that implements this will have some kind of reset button (like they have for other stuff) that will erase all pins. So the site is not really bricked, but still it's pretty embarrassing to have to have a message on their home page like "Chrome for Mac OS X users of, due to an administrative error, please select the 'Clear Browsing Data…' menu item from the Chrome menu, select 'the beginning of time' from the dropdown menu, and check the 'dynamic public key pins' box. Then click 'Clear browsing data'. Sorry for the inconvenience."
> Perhaps we have a different working definition of "bricked"? By
> bricked, I meant that HPKP pins were set which the site no longer has
> the ability to satisfy, period. There are many ways that this could
> happen-pinning to two end-entity keys and losing the private keys,
> attempting to pin to a CA key but entering the hash incorrectly, and
> still having the pins accepted since the end-entity key pin is valid,
> or a malicious bricking with a mis-issued certificate. In this case, a
> bricked domain would be unable to show anything at all to users, so
> they couldn't ask users to hit a "reset pins" button as you suggest.
> Some users might figure it out through an alternate channel like
> Googling "why is down??", but it would be awful to train users
> to ever follow advice to nuke their local state like that.

So, certainly, as discussed during past meetings, and similar to the
discussions of HSTS, HPKP represents potential privacy bits being
disclosed to an attacker ("Have you been here before, and if so,
when/under what keys?"). As such, it's natural to assume/expect that
browsers will have a way to clear received dynamic pins, as part of
the normal clearing of privacy state-related data.

However, sites / site operators encouraging users to do so would be
bad for users' security - it would essentially flush their pins,
allowing potentially misissued certs to be used. If I was a 'clever'
attacker, and I had the ability to display such messages, then in the
face of being unable to attack a pinned site, I would look for a
popular-but-not-pinned site and deliberately inject bad pins (DoS'ing
the site from the users' perspective), along with some sort of message
of "Hey, clear your pins for this site to work"

Once the user cleared their pins, I would be able to attack the target
site, which would now be unpinned.

Alternative models (such as temporarily ignoring pins) sort of flies
in the face of our experiences with HSTS and the general
browser/usability issues with bypassing warnings. Clearing on a
per-site basis is the same as a bypass mode, and then we're just
talking about the number of clicks to get there - also a poor security

>>> If there were a max-age of 60 days, would the Chrome team take a hard
>>> line of "Sorry, you'll just have to wait it out"? Or would
>>> they ship a patch to disables HPKP for, fearing that otherwise
>>> some users will just switch to another browser to regain access?
>> I don't think any of us like the answer, but this probably depends on who 'foo' is. You don't brick Gmail, Hotmail, Paypal, or any major bank in the US. ? I don't see any of the major browser issuing a patch to bail them out.
> I'm can live with that answer, though I'd be curious to hear from the
> Chrome developers (who are likely to be the pioneers here). If a
> channel to whitelist misconfigured HPKP domains is going to be built,
> it changes the discussion around max-age limits to be mostly a
> performance optimization and I don't think it's a good security
> tradeoff.

I don't have any answer for this at this time. There are obviously a
set of security trade-offs here.

Do you trust/want your browser vendor to deliver secure pins (aka
pre-loaded pins)?
Do you trust/want your browser vendor to deliver unpins (of dynamic pins)?

The risks and likely responses to the first question are very
different than those of the second.