Re: [websec] default value for max-age ? (was: Re: Strict-Transport-Security syntax redux)

Tobias Gondrom <> Wed, 04 January 2012 10:05 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 9B21F21F870E for <>; Wed, 4 Jan 2012 02:05:41 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -96.778
X-Spam-Status: No, score=-96.778 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FH_HELO_EQ_D_D_D_D=1.597, HELO_DYNAMIC_IPADDR=2.426, HELO_EQ_DE=0.35, HELO_MISMATCH_DE=1.448, USER_IN_WHITELIST=-100]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id 6sSCcvufqzdy for <>; Wed, 4 Jan 2012 02:05:41 -0800 (PST)
Received: from ( []) by (Postfix) with ESMTP id 8EEF721F870D for <>; Wed, 4 Jan 2012 02:05:39 -0800 (PST)
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=default;; b=WtR3SgRfa4Sj0cQKwa28i8J67mp6xYw1HglCXhmjtPP+ePCWgDAySnUY8jgultYfT9chN7bkELNu+4WJf8Vx46z4/EcxPdWCaojXK7XtVKPoExhAjzQ+eJPuZGbMgoX7; h=Received:Received:Message-ID:Date:From:User-Agent:MIME-Version:To:Subject:References:In-Reply-To:Content-Type:Content-Transfer-Encoding;
Received: (qmail 3218 invoked from network); 4 Jan 2012 11:05:26 +0100
Received: from unknown (HELO ? ( by with (DHE-RSA-AES256-SHA encrypted) SMTP; 4 Jan 2012 11:05:26 +0100
Message-ID: <>
Date: Wed, 04 Jan 2012 10:05:22 +0000
From: Tobias Gondrom <>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:9.0) Gecko/20111220 Thunderbird/9.0
MIME-Version: 1.0
References: <> <> <>
In-Reply-To: <>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [websec] default value for max-age ? (was: Re: Strict-Transport-Security syntax redux)
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Web Application Security Minus Authentication and Transport <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Wed, 04 Jan 2012 10:05:41 -0000

On 03/01/12 08:22, Julian Reschke wrote:
> On 2012-01-03 07:26, Yoav Nir wrote:
>> On Jan 3, 2012, at 1:29 AM, =JeffH wrote:
>>> Julian wondered..
>>>> wouldn't it make sense to have a default for max-age so it
>>>> can be made OPTIONAL?
>>> hm ... I lean towards keeping max-age as REQUIRED (without a default 
>>> value) and
>>> thus hopefully encouraging deployers to think a bit about this and its
>>> ramifications, and also because its value is so site-specific in 
>>> terms of a web
>>> application's needs, deployment approach, and tolerance for downside 
>>> risk of
>>> breaking itself.
>> I tend to agree, but it's not deployers who are going to do the 
>> thinking - it's the implementers of web servers.
>> So somewhere, in some control panel for IIS, or a config file for 
>> Apache, or some WebUI for some SSL-VPN, there's going to be a 
>> configuration to turn on HSTS, and that product is going to have a 
>> default max-age. The deployers are just going to check the box.
>> I think we should provide guidance for those implementers as to what 
>> is a good default there.
>> ...
> If we know a good default then it should be the default on the wire 
> (IMHO). It would help getting predictable behavior when it's missing. 
> (Right now the spec allows recipients to do anything they want then 
> it's missing, right?)
> Best regards, Julian

well, the optimal default may actually be depending on the host.
So we might want to describe what good values might be under which 
E.g. long time-spans when using very trusted process and provider, 
shorter time-spans with less capable / higher risk of bricking yourself 
/ loosing your private key / ...

Thinking about the idea default of max-age = 0: AFAIK this would be 
equivalent to it being disabled, correct? (Not sure I'd like that: 
imagine in an Admin GUI you enable HSTS/Cert Pinning and then don't set 
the max-age and have basically disabled it....)
On the other hand I believe the optimal value would be host specific, 
and therefore there SHOULD NOT be a global default value !=0. :-(
(=> Thereby vanishing myself in a puff of logic...)

Best regards, Tobias