Subject: [websec] fyi: State of HSTS Deployment in 2013-Oct

From: =JeffH <[email-masked]>
Date: Sat, 09 Aug 2014 22:53:31 -0700

Here's an interesting & relevant draft paper by Lucas Garron (and Andrew 
Bortz & Dan Boneh)..

   The State of HSTS Deployment:  A Survey and Common Pitfalls
   https://garron.net/crypto/hsts/hsts-2013.pdf

Note that "S 8.5 Securing https://example.com from a subdomain" is 
essentially the issue that Eric Lawrence recently filed against RFC6797 HSTS.

The paper is worth a read, and the scan code is here..

   https://github.com/lgarron/HSTS/tree/scan

..see also the discussion in this thread on <[email-masked]>..

   State of HSTS in on the Web (2013)
 
https://groups.google.com/a/chromium.org/forum/#!topic/security-dev/Ibdf-x_uqEs

HTH,

=JeffH

---

From: Tobias Gondrom <[email-masked]>
Date: Sun, 10 Aug 2014 10:59:49 +0100

Hi Jeff,

thanks for sharing. Good paper and interesting read.

Even though things are slowly picking up in adoption, a bit
disappointing it's been only 277 out of 100000 sites in Oct 2013. (on a
personal note: this is consistent with my personal anecdotal experience:
as part of overall secure development training, I also mention HSTS to
developers a couple of times per year, and so far nearly none of them
used it before...)

Best regards, Tobias

Ps.: and as Lucas wrote, he initially prepared the document as a
conference paper. In case he is interested, this might be an interesting
submission for an AppSec conference in 2015 (the 2014 ones are
unfortunately already finished or past CFP). (e.g. AppSecUS or AppSecEU)

On 10/08/14 06:53, =JeffH wrote:
> Here's an interesting & relevant draft paper by Lucas Garron (and
> Andrew Bortz & Dan Boneh)..
>
> _______________________________________________
> websec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/websec

---

From: Yoav Nir <[email-masked]>
Date: Sun, 10 Aug 2014 14:38:35 +0300

On Aug 10, 2014, at 12:59 PM, Tobias Gondrom <[email-masked]> wrote:

> used it before…)

My anecdotal evidence is that I tried to promote it at the company where I work. We sell (among other things) an SSL-VPN gateway. That is pretty much a pre-packaged web server, configurable to provide access to company resources such as email, ERP and whatever else employees need over a web interface. 

At first this looked to me like a great candidate for HSTS - it’s only HTTPS, no HTTP. It’s pre-packaged, so we could add it without the administrators needing to do any work. In the end, what killed the idea was what happens when certificates expire or when a valid certificate is replaced by an almost-valid certificate (missing alternate name). The administrators of our products run the gamut from IT professionals who have been through our administration courses all the way to the CEO’s nephew who’s really good with computers (‘cause he’s got his own Facebook profile and everything). We felt it was too risky to just ship the server with HSTS on. 

It’s still possible to turn it on by editing some Apache configuration files, but you really want security to be on by default.

Yoav

---

From: Joseph Bonneau <[email-masked]>
Date: Sun, 10 Aug 2014 19:17:56 -0400

Hi all,

Michael Kranch and I have undertaken a similar effort this summer to study
both HSTS and key pinning in practice. Standard disclaimer, this is a
working draft that hasn't been peer reviewed yet (it's currently under
submission), but here's a draft of our findings:
http://jbonneau.com/doc/KB14-hsts_pinning_survey_working_draft.pdf

Compared to Lucas et al.'s paper our crawl was actually slightly smaller
(top 10k sites) but is more up-to-date and we checked for a few more
things. In particular we have a breakdown of bugs due to errors with the
interaction of cookies and pinning/HSTS and a survey of pinning "mixed
content" which I haven't seen documented previously. We'll get the code up
publicly soon as well.

Hopefully our work is also of interest to this list and we'd very much
appreciate any feedback!

Cheers,

Joe

On Sun, Aug 10, 2014 at 7:38 AM, Yoav Nir <[email-masked]> wrote:

> My anecdotal evidence is that I tried to promote it at the company where I
> work. We sell (among other things) an SSL-VPN gateway. That is pretty much
> a pre-packaged web server, configurable to provide access to company
> resources such as email, ERP and whatever else employees need over a web
> interface.
>
> At first this looked to me like a great candidate for HSTS - it’s only
> HTTPS, no HTTP. It’s pre-packaged, so we could add it without the
> administrators needing to do any work. In the end, what killed the idea was
> what happens when certificates expire or when a valid certificate is
> replaced by an almost-valid certificate (missing alternate name). The
> administrators of our products run the gamut from IT professionals who have
> been through our administration courses all the way to the CEO’s nephew
> who’s really good with computers (‘cause he’s got his own Facebook profile
> and everything). We felt it was too risky to just ship the server with HSTS
> on.
>
> It’s still possible to turn it on by editing some Apache configuration
> files, but you really want security to be on by default.
>
> Yoav
>