Subject: [websec] key-pinning overrides and reporting

From: Igor Bukanov <[email-masked]>
Date: Wed, 21 May 2014 07:16:05 +0200

It is not clear from draft-ietf-websec-key-pinning how reporting
interacts with a user-defined policy or with a disabled pin
validation.

For example, if UA allows to proceed for connections with a locally
installed certificate on a pin mismatch, should the report still be
generated?

---

From: Yoav Nir <[email-masked]>
Date: Thu, 22 May 2014 10:49:13 +0300

Interesting question. IMO (no hats) the answer should be no. If the UA has disabled pin validation (as section 2.6 says it may) then it should not send reports either.

Yoav

On May 21, 2014, at 8:16 AM, Igor Bukanov <[email-masked]> wrote:

> _______________________________________________
> websec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/websec

---

From: Chris Palmer <[email-masked]>
Date: Tue, 27 May 2014 11:28:31 -0700

> Interesting question. IMO (no hats) the answer should be no. If the UA has disabled pin validation (as section 2.6 says it may) then it should not send reports either.

Thanks for raising the question, Igor. I am inclined to agree with
Yoav. Anyone else have thoughts?

Is section 2.6 a good place to put a note about this issue? Proposed text:

"""
If Pin Validation is not in effect (e.g. because the user has elected
to disable it, or because a presented certificate chain chains up to a
locally-installed anchor), and if the server has set a report-uri in a
PKP or PKP-RO header, the UA SHOULD NOT send any reports to the
report-uri for the given certificate chain.
"""

---

From: Igor Bukanov <[email-masked]>
Date: Wed, 28 May 2014 08:03:11 +0200

This is somewhat related to the question if a website in general
should be allowed to know if the user uses non-approved certificate
that is installed on her device. This is important if one considers a
possibility of using social engineering to trick the user to install a
new certificate authority that allows to perform MTM attacks. I know
banks worry about that.

However, allowing such knowledge to websites has a privacy
implications. Besides social engineering arguments are weak as a user
can be just as well tricked to install a special browser that skips
any ssl checks. So the proposed text change is good.