[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <53DD995B.6010709@redhat.com>
Date: Sat, 02 Aug 2014 20:07:23 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com, gremlin@...mlin.ru
Subject: Re: CVE Request: Enforce use of HTTPS for MathJax
in IPython
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 02/08/14 02:31 PM, Donald Stufft wrote:
> On August 2, 2014 at 1:08:12 PM, gremlin@...mlin.ru
> (gremlin@...mlin.ru) wrote:
>> Enforcing HTTPS for the whole site is even more stupid: normally
>> only user-specific data (login procedure, personal settings for
>> registered users, etc) should be forced to go through HTTPS;
>> everything else should normally be left up to the users' wish.
>
> This is incredibly wrong. First off if only your login procedures,
> personal
+1. If you commit to encrypting the entire site then you can do things
like:
http://dev.chromium.org/sts
http://src.chromium.org/viewvc/chrome/trunk/src/net/http/transport_security_state_static.json
So anyone using Chrome will be forced, by their browser, to use HTTPS
for cloudsecurityalliance.org for example. I never have to worry about
SSL strip, becuase chrome will actually convert anything I type into
the address bar from the default http to https, and if I specify http
explicitly it will still send the request out as https.
You can also serve HSTS headers for browsers that don't have a
whitelist that you can be added to easily (basically all of them other
than chrome).
It's not about the users wish. It's about the site's wish. The site is
providing the service, the site provides the TOS/AUP/etc. The site may
choose optionally to leave it up to the user, but this is a VERY bad
idea.
- --
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQIcBAEBAgAGBQJT3ZlbAAoJEBYNRVNeJnmTtEUP+wRQxsSRb7rFcLFaHFqhCiSv
NzVYlNqRHKksqG+bBcsYoEat+SERAPgbQ8hPGF6b04LiuZ2YD72Mljki3GHYORhk
lTcy4t3AKUYp35d60EscUnEM+ZjGe6ZVnqSh+V12SBmOmX68CGbmF2ftSQiW5eUT
86jF0SF2AMwplNX5KkBNss+XdykV6kUyL8xEFHs4N7zGUruUXy/Kdob7f9iHguD+
isAykcmXtx0CKytPAne1HTEYvH4sHdbFig7iTJ9vvmpBPxUyWXVFSU3CmIsf1cMY
CU7lMxmQnIiGJ7oTNtrEzPr9OQpOd6Ok1oBklhMAiy3okQq9fdSPjZTkCwoAUdw6
be6v+NgGQuIl485iWQ4R2TrPeY+2EJnBUzVTfE49VFEPAn4KlQnwTouv9MdsyIP1
XZxZDWPxyD5U4iRq2IMuplzgkB0tAYmf2VFTUqXeq/B+leZAXChJBJHxcwG5bRlv
IUu6yppD7T9ZwQ4qkLVSji9NBHheYoMIH8IHajf9FI3/3fi/okOqNrdG3ycpzH4F
zKfENDcdsIUnEcJ3IxN+f2a82FHpcTKDh/UcDv5nnWMzOatan9EhSirQ4NPU4YVk
q/P/loY0UaabDZkyEUBc+PENhuP/pYgqxzpbt2/6F+nvvrFGJt8dS/+RZv2piA95
Hb/bT6uSzzfXF9FvEwZ7
=e6lX
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
