Subject: [Uta] MTA-STS (RFC 8461) policy standard problem

From: Alice Wonder <[email-masked]>
Date: Mon, 11 Mar 2019 14:51:17 -0700

Hi,

I apologize if this covered in the RFC and I did not see it, but I did 
look for it.

While working on a script that fetches MTA-STS policies I encountered 
two problems:

A) Some servers refuse connection if the client does not send a user 
agent header.

B) Some servers refuse connections if you do send a user agent but the 
server (correctly) identifies it as a bot rather than a browser.

RCF 8641 should be updated to REQUIRE that the policy server does NOT 
reject requests without a user agent or with a user agent that the 
server does not like.

Interference with automated retrieval of the policy means the policy 
does not get applied.

It is not a common problem, seems to happen most often when the policy 
is hosted at cloudflare yet some policies hosted at cloudflare seem to 
not have this issue.

I'm not going to tell my script to lie in its user agent string, even 
though that works. Dishonest identity of software should not be required 
to implement a security policy.

---

From: Daniel Margolis <[email-masked]>
Date: Fri, 15 Mar 2019 14:53:05 +0100

Hi, Alice,

If we were still in draft mode I would update it to call out this risk, but
I don't think this warrants publishing a new version, though I think you
are making a totally valid observations.

In particular, a domain is not implementing a compliant MTA-STS policy if
they don't allow the policy to be fetched by compliant HTTPS clients, I
would say. Some DOS-protection is of course reasonable, and sophisticated
implementers will throttle clients to reasonable rates. But e.g. simply
showing a reCAPTCHA before anyone can ever talk to your HTTPS server is, of
course, a poor approach to this.

I think this may be a good feature request to Cloudflare. I think it's
reasonable for them to detect if someone is pointing an "mta-sts" record at
their service, and warn their users that this is not going to end well. :)

I agree, by the way, that you should not lie in the U-A string. Just treat
these domains as not having an MTA-STS policy (which is what the RFC says
you should do if you can't fetch it).

Dan

On Mon, Mar 11, 2019 at 10:51 PM Alice Wonder <[email-masked]> wrote:

> _______________________________________________
> Uta mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/uta
>

-- 
How's my emailing? http://go/dan-email-slo