Comment by agl | Hacker News Reader

Comment by agl | Hacker News Reader

Parent Full thread

1) You can address it in Chrome with pinning [1]. Built in pins require that you be a significant site, but you can also set them with HTTP headers [2].

[1] http://www.imperialviolet.org/2011/05/04/pinning.html [2] http://tools.ietf.org/html/draft-ietf-websec-key-pinning-01

This is a rather poor solution. The longer term one is Certificate Transparency: http://www.links.org/?p=1219

2) is solved with HSTS [3]. You can contact me (@chromium.org) to be built in. There isn't a notability requirement.

[3] http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security

3) The BEAST attack was tough to pull off and is fixed with Chrome, FF10 and IE.

http://www.imperialviolet.org/2012/01/15/beastfollowup.html

4) Yep, cookies must be marked secure. HSTS can also fix this my eliminating the insecure requests. Even with secure cookies (but without HSTS), a MITM can also set the cookie. (i.e. to log you in to their account before you hit 'send' and then to log you back into yours before you notice the problem.)

2) is solved with HSTS [3]. You can contact me (@chromium.org) to be built in. There isn't a notability requirement.

I don't understand that. If I serve http://example.com/mypage which has a link to http://mint.com/justin, you won't convert that to https://mint.com/justing, right? Even if example.com has HSTS enabled? Cause that would assume that mint.com has https, or else the whole thing breaks.

Cause in that case a man in the middle can just insert links to other domains (say, http://examp1e.com/myotherpage when I was serving a link to http://example.com/myotherpage) and still have the attack work. Like the GP said, only starting at an HTTPS page would solve this.

But you're the expert and I'm not, so what am I missing? :-)

as long as mint.com has HSTS and either the user has been there once before or it was hard coded into the browser as an HSTS domain then the browser will never visit http://mint.com, it will immediately go to https://mint.com

EDIT: and well it doesn't seem that mint.com even has HSTS enabled... so bad example :P

Good points. Additionally: if you control the client, you can also trust your own CA only, or even just require a specific certificate.

Reply on news.ycombinator.com