IETF Logo Mail Archive

Re: [websec] handling STS header field extendability

"Hill, Brad" <bhill@paypal-inc.com> Mon, 13 August 2012 21:40 UTC

Return-Path: <bhill@paypal-inc.com>
X-Original-To: websec@ietfa.amsl.com
Delivered-To: websec@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B063321F8605 for <websec@ietfa.amsl.com>; Mon, 13 Aug 2012 14:40:56 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -9.117
X-Spam-Level:
X-Spam-Status: No, score=-9.117 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599, DNS_FROM_RFC_BOGUSMX=1.482, RCVD_IN_DNSWL_HI=-8]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LJe4TMPYIU6V for <websec@ietfa.amsl.com>; Mon, 13 Aug 2012 14:40:56 -0700 (PDT)
Received: from den-mipot-002.corp.ebay.com (den-mipot-002.corp.ebay.com [216.113.175.153]) by ietfa.amsl.com (Postfix) with ESMTP id 256A821F85DF for <websec@ietf.org>; Mon, 13 Aug 2012 14:40:56 -0700 (PDT)
DomainKey-Signature: s=ppinc; d=paypal-inc.com; c=nofws; q=dns; h=X-EBay-Corp:X-IronPort-AV:Received:Received:From:To:CC: Subject:Thread-Topic:Thread-Index:Date:Message-ID: References:In-Reply-To:Accept-Language:Content-Language: X-MS-Has-Attach:X-MS-TNEF-Correlator:x-originating-ip: x-ems-proccessed:x-ems-stamp:Content-Type: Content-Transfer-Encoding:MIME-Version:X-CFilter; b=vYZLxTDQdqh4/r1hOXNkBJwqyyyb3GVRDcfKJeqSFkhw12hpNvCN/8kF DmgNHSoeMTBVBgFNCwZTjEuRU3zCfahOg3kUzU8AGV8VO5rPdUYarFGgV 2A5faV6/Sw4aBaZ;
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=paypal-inc.com; i=bhill@paypal-inc.com; q=dns/txt; s=ppinc; t=1344894056; x=1376430056; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=NF8DerJctzySio23qLVutOUzzDdkebwAlQKvTJL3fuU=; b=VtR81EsRAzlYtOL0q6q1J7QkeeRyPDyhqh2qyD3VIA0P+vaNXNzVWsW/ l6eWMCwHHl5mJnRzUVC0LXmYjOrKzJbkorO3Kth4u1ZRwJaQCKQW5PO6c hIMbv+qfIoQTCAp;
X-EBay-Corp: Yes
X-IronPort-AV: E=Sophos;i="4.77,762,1336374000"; d="scan'208";a="9633874"
Received: from den-vtenf-001.corp.ebay.com (HELO DEN-EXMHT-003.corp.ebay.com) ([10.101.112.212]) by den-mipot-002.corp.ebay.com with ESMTP; 13 Aug 2012 14:40:55 -0700
Received: from DEN-EXDDA-S12.corp.ebay.com ([fe80::40c1:9cf7:d21e:46c]) by DEN-EXMHT-003.corp.ebay.com ([fe80::55d3:9d86:3fc8:dbf4%14]) with mapi id 14.02.0298.004; Mon, 13 Aug 2012 15:40:55 -0600
From: "Hill, Brad" <bhill@paypal-inc.com>
To: Chris Palmer <palmer@google.com>, Collin Jackson <collin.jackson@sv.cmu.edu>
Thread-Topic: [websec] handling STS header field extendability
Thread-Index: AQHNdnu9G2/cgF2QOE2DrHCPRwkn4JdT/HaAgAEaOQCAAvRWEIAAfk+AgAAhxwD//53jIA==
Date: Mon, 13 Aug 2012 21:40:53 +0000
Message-ID: <370C9BEB4DD6154FA963E2F79ADC6F2E1C2898@DEN-EXDDA-S12.corp.ebay.com>
References: <5024352D.4040604@KingsMountain.com> <CAOuvq23dxoKyV2No55WEYePhVj+Fcab5cF65C1FsiqgtmEkXMA@mail.gmail.com> <CA+cU71kx4Ck2aMeSHhnpb--aZ+mRmszQdojepM4aapVn2TsR=Q@mail.gmail.com> <370C9BEB4DD6154FA963E2F79ADC6F2E1C251C@DEN-EXDDA-S12.corp.ebay.com> <CANVv-VfcVBhd7AUqsZ83dKJiDL3V=_Fd2Wmm=o7WXMiEgCAusg@mail.gmail.com> <CAOuvq20sW5zsR5bSTpNFenmttE2Oj9YCYJHmaKRxUxmpf9w-WQ@mail.gmail.com>
In-Reply-To: <CAOuvq20sW5zsR5bSTpNFenmttE2Oj9YCYJHmaKRxUxmpf9w-WQ@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [10.245.27.242]
x-ems-proccessed: 10SqDH0iR7ekR7SRpKqm5A==
x-ems-stamp: My5LBmPilrzzlRI5vXZEZA==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-CFilter: Scanned
Cc: Ben Campbell <ben@nostrum.com>, IETF WebSec WG <websec@ietf.org>
Subject: Re: [websec] handling STS header field extendability
X-BeenThere: websec@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Web Application Security Minus Authentication and Transport <websec.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/websec>, <mailto:websec-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/websec>
List-Post: <mailto:websec@ietf.org>
List-Help: <mailto:websec-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/websec>, <mailto:websec-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 13 Aug 2012 21:40:56 -0000

> Not to intentionally pick on PayPal — sorry, Brad :) — but the attack works
> because of explicit cross-origin script inclusion. The first demo of this attack I
> saw was by Sotirov and Zusman at CanSecWest some years ago. In the attack
> demo, EV paypal.com includes (included) script from non-EV
> paypalobjects.com. If you distinguish EV paypal.com and non-EV paypal.com
> as distinct origins, it doesn't help anything if either origin explicitly includes
> script from any other origin (of any security level).

[Hill, Brad] No apology needed.  https://www.paypalobjects.com/ is using an EV certificate now, BTW, but I'm quite sure if you looked you could find non-EV content that's being transcluded somewhere. (though hopefully not script src)  

I think that's important to consider about LockEV - PayPal is one of the sites most ready for and most pervasively EV, and it would not be prepared today to have a mixed-content policy enforced for EV/DV.  It would take a lot of work and a great deal of expense to achieve this, and not just for PayPal.  Consider how many sites use off-origin analytics, ads, CDNs, etc.  

The CDN cost also goes way up because EV certificates cannot include multiple logical subjects and XP, Android 2.x and other legacy OSs still prevent SNI from being widely used, so you need to pay for an exclusive IP address from the CDN, in addition to the cost of the EV cert itself.

Mixed-content blocking could very conceivably decrease the usage of EV certs dramatically.

v2.23.0 | Report a Bug | By Email