Return-Path: X-Original-To: websec@ietfa.amsl.com Delivered-To: websec@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3BD901A017A for ; Sun, 10 Aug 2014 16:18:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Y-fQg2Bin9ie for ; Sun, 10 Aug 2014 16:18:41 -0700 (PDT) Received: from mail-vc0-x231.google.com (mail-vc0-x231.google.com [IPv6:2607:f8b0:400c:c03::231]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 25ADF1A0178 for ; Sun, 10 Aug 2014 16:18:41 -0700 (PDT) Received: by mail-vc0-f177.google.com with SMTP id hy4so10795569vcb.36 for ; Sun, 10 Aug 2014 16:18:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; bh=1pFAVtmwExB3ZYKNAkclBozrUDicZEiOSw4/0P2o7Eg=; b=uXloBR7fbcwfH+zsCBEfHLASRyfDL98RvHF1YxrIZW3oOi/hBKTPJkJxBkVTY3Y48a DOB9FMVfHxkU5wUiYWKCBMqYZix9WjIbJXvKmdwa0GflpdBrzY0q0051iqN4hgiRzmlv 5A1OiBLUmr3UnmajBqVECt1h0h5I3O8CE4vXJrrFgzxB6uSOixFK7jGJX0Ct2uhpUD2N m0dSWkXWvAnzm4anGPYzM041KJWWIKX5+uctfMIDSCScOP1Tcw5NF1xmwBPX9suW4Cd4 oHmUThn8xfcBMNHVS29lBD8Z8sYV1kk/BKiDcEhwde0c1s/xXagQ+rTWehbbvqn95BuC Pv4g== X-Received: by 10.52.6.138 with SMTP id b10mr33083vda.84.1407712720014; Sun, 10 Aug 2014 16:18:40 -0700 (PDT) MIME-Version: 1.0 Received: by 10.220.100.148 with HTTP; Sun, 10 Aug 2014 16:17:56 -0700 (PDT) In-Reply-To: <9324C2B1-7DAA-418B-87C2-7D4CFABD8B1C@gmail.com> References: <53E708DB.4010505@KingsMountain.com> <53E74295.7060402@gondrom.org> <9324C2B1-7DAA-418B-87C2-7D4CFABD8B1C@gmail.com> From: Joseph Bonneau Date: Sun, 10 Aug 2014 19:17:56 -0400 Message-ID: To: Yoav Nir Content-Type: multipart/alternative; boundary=20cf302ef2ba9f52c905004ea8dd Archived-At: http://mailarchive.ietf.org/arch/msg/websec/jfAXljLY-Gvd9hzFKNP1zIB445c Cc: "" , "Michael J. Kranch" Subject: Re: [websec] fyi: State of HSTS Deployment in 2013-Oct X-BeenThere: websec@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Web Application Security Minus Authentication and Transport List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 10 Aug 2014 23:18:43 -0000 --20cf302ef2ba9f52c905004ea8dd Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Hi all, Michael Kranch and I have undertaken a similar effort this summer to study both HSTS and key pinning in practice. Standard disclaimer, this is a working draft that hasn't been peer reviewed yet (it's currently under submission), but here's a draft of our findings: http://jbonneau.com/doc/KB14-hsts_pinning_survey_working_draft.pdf Compared to Lucas et al.'s paper our crawl was actually slightly smaller (top 10k sites) but is more up-to-date and we checked for a few more things. In particular we have a breakdown of bugs due to errors with the interaction of cookies and pinning/HSTS and a survey of pinning "mixed content" which I haven't seen documented previously. We'll get the code up publicly soon as well. Hopefully our work is also of interest to this list and we'd very much appreciate any feedback! Cheers, Joe On Sun, Aug 10, 2014 at 7:38 AM, Yoav Nir wrote: > > On Aug 10, 2014, at 12:59 PM, Tobias Gondrom > wrote: > > > Hi Jeff, > > > > thanks for sharing. Good paper and interesting read. > > > > Even though things are slowly picking up in adoption, a bit > > disappointing it's been only 277 out of 100000 sites in Oct 2013. (on a > > personal note: this is consistent with my personal anecdotal experience= : > > as part of overall secure development training, I also mention HSTS to > > developers a couple of times per year, and so far nearly none of them > > used it before=E2=80=A6) > > My anecdotal evidence is that I tried to promote it at the company where = I > work. We sell (among other things) an SSL-VPN gateway. That is pretty muc= h > a pre-packaged web server, configurable to provide access to company > resources such as email, ERP and whatever else employees need over a web > interface. > > At first this looked to me like a great candidate for HSTS - it=E2=80=99s= only > HTTPS, no HTTP. It=E2=80=99s pre-packaged, so we could add it without the > administrators needing to do any work. In the end, what killed the idea w= as > what happens when certificates expire or when a valid certificate is > replaced by an almost-valid certificate (missing alternate name). The > administrators of our products run the gamut from IT professionals who ha= ve > been through our administration courses all the way to the CEO=E2=80=99s = nephew > who=E2=80=99s really good with computers (=E2=80=98cause he=E2=80=99s got= his own Facebook profile > and everything). We felt it was too risky to just ship the server with HS= TS > on. > > It=E2=80=99s still possible to turn it on by editing some Apache configur= ation > files, but you really want security to be on by default. > > Yoav > > _______________________________________________ > websec mailing list > websec@ietf.org > https://www.ietf.org/mailman/listinfo/websec > --20cf302ef2ba9f52c905004ea8dd Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Hi all,

Michael Kranch and I have under= taken a similar effort this summer to study both HSTS and key pinning in pr= actice. Standard disclaimer, this is a working draft that hasn't been p= eer reviewed yet (it's currently under submission), but here's a dr= aft of our findings:=C2=A0http://jbonneau.com/doc/KB14-hsts_pinning_sur= vey_working_draft.pdf

Compared to Lucas et al.'s paper our crawl was actu= ally slightly smaller (top 10k sites) but is more up-to-date and we checked= for a few more things. In particular we have a breakdown of bugs due to er= rors with the interaction of cookies and pinning/HSTS and a survey of pinni= ng "mixed content" which I haven't seen documented previously= . We'll get the code up publicly soon as well.

Hopefully our work is also of interest to this list and= we'd very much appreciate any feedback!

Cheer= s,

Joe


On Sun, Aug 10, 2014 at 7:38 AM, Yoav Nir <ynir.ietf@gmail.com> wrote:

On Aug 10, 2014, at 12:59 PM, Tobias Gondrom <tobias.gondrom@gondrom.org> wrote:

> Hi Jeff,
>
> thanks for sharing. Good paper and interesting read.
>
> Even though things are slowly picking up in adoption, a bit
> disappointing it's been only 277 out of 100000 sites in Oct 2013. = (on a
> personal note: this is consistent with my personal anecdotal experienc= e:
> as part of overall secure development training, I also mention HSTS to=
> developers a couple of times per year, and so far nearly none of them<= br>
> used it before=E2=80=A6)

My anecdotal evidence is that I tried to promote it at the company where I = work. We sell (among other things) an SSL-VPN gateway. That is pretty much = a pre-packaged web server, configurable to provide access to company resour= ces such as email, ERP and whatever else employees need over a web interfac= e.

At first this looked to me like a great candidate for HSTS - it=E2=80=99s o= nly HTTPS, no HTTP. It=E2=80=99s pre-packaged, so we could add it without t= he administrators needing to do any work. In the end, what killed the idea = was what happens when certificates expire or when a valid certificate is re= placed by an almost-valid certificate (missing alternate name). The adminis= trators of our products run the gamut from IT professionals who have been t= hrough our administration courses all the way to the CEO=E2=80=99s nephew w= ho=E2=80=99s really good with computers (=E2=80=98cause he=E2=80=99s got hi= s own Facebook profile and everything). We felt it was too risky to just sh= ip the server with HSTS on.

It=E2=80=99s still possible to turn it on by editing some Apache configurat= ion files, but you really want security to be on by default.

Yoav

_______________________________________________
websec mailing list
websec@ietf.org
= https://www.ietf.org/mailman/listinfo/websec

--20cf302ef2ba9f52c905004ea8dd--