Subject: [TLS] fyi: (HTTP) Strict Transport Security and HASMAT (was: Eleven out of every ten SSL certs aren't valid)

From: =JeffH <[email-masked]>
Date: Wed, 30 Jun 2010 20:05:15 -0700

Hi,

Ivan Ristic <[email-masked]> replied..
 >
 > On Tue, Jun 29, 2010 at 8:34 PM, Nicolas Williams
 > <[email-masked]> had written..
 >
 >> If you want to discuss how to improve the clients (e.g.,
 >> make it so there is no warning dialog, make it so you cannot connect to
 >> sites with bad certs period).
 >
 > I would like to see that very much (and have proposed it in the past).
 > Unfortunately, browser vendors will never do that for the fear of
 > losing customers.

That's not exactly true at this time.

Strict Transport Security (STS (or HSTS as it might be re-acronymed)) addresses 
a swath of these issues by facilitating a web site to declare to clients that 
it must be communicated with only over a secure transport i.e. TLS/SSL. There 
are of course a bunch of subtle aspects to this, so I won't address them here 
(pointer to I-D is below).

Note that HSTS (nee STS) is presently implemented in Google Chrome 4.x, is 
coming in Firefox 4, is available as Force-TLS Firefox extension, as well as 
the HTTPS Everywhere FF extension, and is a feature of the NoScript FF 
extension. Also, www.PayPal.com presently sets this policy (we're actively 
encouraging others to do so too).

Here is the present HSTS I-D..

   HTTP Strict Transport Security
   http://www.ietf.org/id/draft-hodges-strict-transport-sec-01.txt

..please discuss HSTS particulars on the HASMAT list..

    [HASMAT]   "HASMAT -- HTTP Application Security Minus Authentication
               and Transport",
               <https://www.ietf.org/mailman/listinfo/hasmat>

..and please attend the BoF in Maastricht in a few weeks :)

See also..

   http://en.wikipedia.org/wiki/Strict_Transport_Security

=JeffH

PS: we're also encouraging all browser vendors to support HSTS.

PPS: Chrome 4 also sports a "STS pre-loaded list"..

   http://dev.chromium.org/sts