Subject: Re: HSTS Fingerprinting.

From: Mike West <[email-masked]>
Date: Tue, 1 Oct 2019 15:47:53 +0200

Ping!

If this group doesn't feel any particular ownership, I'm happy to try to
define some web browsery behavior in W3C/WHATWG. If y'all would prefer an
RFC6797bis, great!

-mike

On Wed, Sep 18, 2019 at 3:10 AM Mike West <[email-masked]> wrote:

> A year or two ago, +John Wilander <[email-masked]> and others at
> Apple proposed some changes to HSTS in
> https://webkit.org/blog/8146/protecting-against-hsts-abuse/ that went
> some way towards mitigating the abuses documented in Section 14.9 of
> RFC6797 <https://tools.ietf.org/html/rfc6797#section-14.9>. Given some
> shifts in the way we're thinking about some other concepts, I've written up
> a short proposal at https://github.com/mikewest/strict-navigation-security that
> builds upon and simplifies Apple's proposal. We discussed it briefly at
> yesterday's webappsec meeting
> <https://github.com/w3c/webappsec/blob/master/meetings/2019/2019-09-TPAC-minutes.md#hsts-fingerprinting>,
> and there seems to be interest in doing something in this space.
>
> +Mark Nottingham <[email-masked]> and +Jeff Hodges <[email-masked]> suggested
> that I loop this group into that conversation, as the original websec group
> has disbanded. Is it a topic this group would like to pick up? If not,
> would y'all be comfortable with us defining some web browser behavior/Fetch
> integration in webappsec that constrains the existing RFC?
>
> Thanks!
>
> -mike
>

---

From: John Wilander <[email-masked]>
Date: Tue, 01 Oct 2019 08:33:11 -0700

Hi!

Just to be clear, what we saw in the wild was not HSTS fingerprinting but rather using HSTS as a deliberate stateful tracking vector. Maybe if sites were probing the dynamic HSTS cache in general could it be called fingerprinting but I try to reserve that term for stateless tracking.

   Regards, John

> On Oct 1, 2019, at 6:51 AM, Mike West <[email-masked]> wrote:
> 
> 
> Ping!
> 
> If this group doesn't feel any particular ownership, I'm happy to try to define some web browsery behavior in W3C/WHATWG. If y'all would prefer an RFC6797bis, great!
> 
> -mike
> 
> 
>> A year or two ago, +John Wilander and others at Apple proposed some changes to HSTS in https://webkit.org/blog/8146/protecting-against-hsts-abuse/ that went some way towards mitigating the abuses documented in Section 14.9 of RFC6797. Given some shifts in the way we're thinking about some other concepts, I've written up a short proposal at https://github.com/mikewest/strict-navigation-security that builds upon and simplifies Apple's proposal. We discussed it briefly at yesterday's webappsec meeting, and there seems to be interest in doing something in this space.
>> 
>> +Mark Nottingham and +Jeff Hodges suggested that I loop this group into that conversation, as the original websec group has disbanded. Is it a topic this group would like to pick up? If not, would y'all be comfortable with us defining some web browser behavior/Fetch integration in webappsec that constrains the existing RFC?
>> 
>> Thanks!
>> 
>> -mike

---

From: Mark Nottingham <[email-masked]>
Date: Thu, 3 Oct 2019 15:59:44 +1000

Hey Mike,

I wouldn't treat the silence as indicative of disinterest.

Would you be willing to write up a short draft explaining your proposal and submit it for discussion in Singapore (presenting remotely if necessary)? Even if you decide not to do it here, I suspect you'll be able to reuse the markdown...

Cheers,

> On 1 Oct 2019, at 11:47 pm, Mike West <[email-masked]> wrote:
> 
> Ping!
> 

--
Mark Nottingham   https://www.mnot.net/

---

From: Mike West <[email-masked]>
Date: Mon, 7 Oct 2019 13:47:52 +0200

Ok, thanks Mark. I'll aim to have an ID up by whenever the Singapore cutoff
turns out to be.

-mike

On Thu, Oct 3, 2019 at 7:59 AM Mark Nottingham <[email-masked]> wrote:

> Would you be willing to write up a short draft explaining your proposal
> and submit it for discussion in Singapore (presenting remotely if
> necessary)? Even if you decide not to do it here, I suspect you'll be able
> to reuse the markdown...
>
> Cheers,
>
>
> > A year or two ago, +John Wilander and others at Apple proposed some
> changes to HSTS in
> RFC6797. Given some shifts in the way we're thinking about some other
> concepts, I've written up a short proposal at
> https://github.com/mikewest/strict-navigation-security that builds upon
> and simplifies Apple's proposal. We discussed it briefly at yesterday's
> webappsec meeting, and there seems to be interest in doing something in
> this space.
> >
> > +Mark Nottingham and +Jeff Hodges suggested that I loop this group into
> that conversation, as the original websec group has disbanded. Is it a
> topic this group would like to pick up? If not, would y'all be comfortable
> with us defining some web browser behavior/Fetch integration in webappsec
> that constrains the existing RFC?
> >
> > Thanks!
> >
> > -mike
>
> --

---

From: Mark Nottingham <[email-masked]>
Date: Tue, 8 Oct 2019 10:17:51 +1100

4 November; see <https://datatracker.ietf.org/meeting/106/important-dates/>.

Cheers,

> On 7 Oct 2019, at 10:47 pm, Mike West <[email-masked]> wrote:
> 
> Ok, thanks Mark. I'll aim to have an ID up by whenever the Singapore cutoff turns out to be.
> 
> -mike
> 
>

---

From: Jeff Hodges <[email-masked]>
Date: Mon, 7 Oct 2019 16:46:56 -0700

[ just us ]

ah, ok, something to chat about on Wed -- ie, are you thinking a
monkey-patch of rfc6797 or an entire updated spec, or ...?

On Mon, Oct 7, 2019 at 4:48 AM Mike West <[email-masked]> wrote:

>> > If this group doesn't feel any particular ownership, I'm happy to try
>> to define some web browsery behavior in W3C/WHATWG. If y'all would prefer
>> an RFC6797bis, great!
>> >
>> > -mike
>> >
>> >

-- 
Thanks, HTH,

=JeffH

---

From: "Martin Thomson" <[email-masked]>
Date: Thu, 10 Oct 2019 13:15:34 +1100

This isn't consensus, but I agree with draft-roach-bis-documents on this subject.  A wholesale replacement can just fix the bits that need fixing.  We do our readership a disservice every time we ship a monkey-patch specification.