Date: Sat, 02 Aug 2014 20:07:23 -0600 From: Kurt Seifried <kseifried@...hat.com> To: oss-security@...ts.openwall.com, gremlin@...mlin.ru Subject: Re: CVE Request: Enforce use of HTTPS for MathJax in IPython -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 02/08/14 02:31 PM, Donald Stufft wrote: > On August 2, 2014 at 1:08:12 PM, gremlin@...mlin.ru > (gremlin@...mlin.ru) wrote: >> Enforcing HTTPS for the whole site is even more stupid: normally >> only user-specific data (login procedure, personal settings for >> registered users, etc) should be forced to go through HTTPS; >> everything else should normally be left up to the users' wish. > > This is incredibly wrong. First off if only your login procedures, > personal +1. If you commit to encrypting the entire site then you can do things like: http://dev.chromium.org/sts http://src.chromium.org/viewvc/chrome/trunk/src/net/http/transport_security_state_static.json So anyone using Chrome will be forced, by their browser, to use HTTPS for cloudsecurityalliance.org for example. I never have to worry about SSL strip, becuase chrome will actually convert anything I type into the address bar from the default http to https, and if I specify http explicitly it will still send the request out as https. You can also serve HSTS headers for browsers that don't have a whitelist that you can be added to easily (basically all of them other than chrome). It's not about the users wish. It's about the site's wish. The site is providing the service, the site provides the TOS/AUP/etc. The site may choose optionally to leave it up to the user, but this is a VERY bad idea. - -- Kurt Seifried -- Red Hat -- Product Security -- Cloud PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBAgAGBQJT3ZlbAAoJEBYNRVNeJnmTtEUP+wRQxsSRb7rFcLFaHFqhCiSv NzVYlNqRHKksqG+bBcsYoEat+SERAPgbQ8hPGF6b04LiuZ2YD72Mljki3GHYORhk lTcy4t3AKUYp35d60EscUnEM+ZjGe6ZVnqSh+V12SBmOmX68CGbmF2ftSQiW5eUT 86jF0SF2AMwplNX5KkBNss+XdykV6kUyL8xEFHs4N7zGUruUXy/Kdob7f9iHguD+ isAykcmXtx0CKytPAne1HTEYvH4sHdbFig7iTJ9vvmpBPxUyWXVFSU3CmIsf1cMY CU7lMxmQnIiGJ7oTNtrEzPr9OQpOd6Ok1oBklhMAiy3okQq9fdSPjZTkCwoAUdw6 be6v+NgGQuIl485iWQ4R2TrPeY+2EJnBUzVTfE49VFEPAn4KlQnwTouv9MdsyIP1 XZxZDWPxyD5U4iRq2IMuplzgkB0tAYmf2VFTUqXeq/B+leZAXChJBJHxcwG5bRlv IUu6yppD7T9ZwQ4qkLVSji9NBHheYoMIH8IHajf9FI3/3fi/okOqNrdG3ycpzH4F zKfENDcdsIUnEcJ3IxN+f2a82FHpcTKDh/UcDv5nnWMzOatan9EhSirQ4NPU4YVk q/P/loY0UaabDZkyEUBc+PENhuP/pYgqxzpbt2/6F+nvvrFGJt8dS/+RZv2piA95 Hb/bT6uSzzfXF9FvEwZ7 =e6lX -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ