Subject: Re: [websec] Testing HSTS browser impls (was: Some questions about HSTS)

From: =JeffH <[email-masked]>
Date: Tue, 23 Nov 2010 15:58:35 -0800

[ am out of the office this week. ]

Adam noted:
 >
 > I suspect the issue with your experiment is that we don't accept
 > Strict-Transport-Security headers over "broken" TLS connections.  This
 > help prevent web sites from shooting themselves in the foot when they
 > think their certificate is valid even though it isn't.

yep.

 > To test this
 > properly, you need to simulate a real attack scenario.  First, receive
 > the HSTS directive over a TLS connection with a valid certificate and
 > then play man-in-the-middle and substitute the attacker's certificate.

Another approach is to use the "STS UI" Firefox add-on 
<https://addons.mozilla.org/en-US/firefox/addon/246797/> by Sid Stamm 
<http://blog.sidstamm.com/2010/10/managing-hsts-data.html> and add your test 
host before performing the experiment.

I'm not aware of a similar extension (or other configuration thingee) for 
Chrome -- tho it does sport a HSTS Pre-loaded list <http://dev.chromium.org/sts>.

=JeffH

---

From: Yoav Nir <[email-masked]>
Date: Wed, 24 Nov 2010 09:56:14 +0200

Hi Jeff

At first I thought that might be the case, but I closed and restarted the browser, and still the browser went directly to port 443. This happened both in Chrome and in Firefox.

Yoav

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of =JeffH
Sent: 24 November 2010 01:59
To: IETF WebSec WG
Subject: Re: [websec] Testing HSTS browser impls (was: Some questions about HSTS)

yep.