Subject: Re: [websec] Decouple HSTS's two orthogonal effects?

From: =JeffH <[email-masked]>
Date: Fri, 25 Mar 2011 11:29:19 -0700

Tobias wrote:
 >
 > I also do not share your view.

+1

 > HSTS has one goal and that is to ensure a
 > secure and trusted connection to prevent MiM and spoofing attacks. For
 > this a strict behavior must be enforced. That means only https
 > connections are allowed and self-signed certificates must be rejected.

well, I'd characterize the latter more accurately as "TLS connections whose 
certs have signatures that don't chain up to a locally-cached trust anchor are 
terminated."

 > Otherwise an attacker uses exactly this to bypass the protection.
 >
 > Considering Tom's scenarios of self-signed certificates for intranet-site:
 > - As devdatta writes you should in that case deploy the certs  to your
 > browser.

HSTS is not necessarily appropriate for every web app in all network contexts 
to advertise. It is intended for use by web apps that understand both its 
benefits and operational characteristics and who are willing to accept the 
latter in exchange for the former.

and yes, if one really needs to wield self-signed certs in a particular 
context, there are various ways to get the appropriate trust anchor(s) loaded 
in the browsers. But then one should also assess whether employing HSTS in that 
context is appropriate.

=JeffH