Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

HTTPS is subject to several MITM attacks, that is clear. However I think it would be helpful to the ITSec crowd if there was a way to force a certain browser behaviour when accessing known-trusted sites.

Based on my (average) knowledge of MITM vectors, it would be beneficial to secure specific domains with client/browser behavior that forced any of the following settings :

  • Only use HTTPS when connecting domain X

  • Require an If-Modified-Since header. Ideally, I want cached content to never expire, regardless of what the "server" says.

  • Require SSL Only Cookies. I am looking for a way for the browser to require SSL Only cookies by DNS domain name, and possibly by cookie name.

  • Ignore 30x redirects.

Ultimately, I would like to take the recommendations and format them into a security guide for the end user, or actually deploy them internally to all internal clients, when connecting to a secured list of websites.

share|improve this question
    
This seems very much like a question for superuser site. –  Nam Nguyen Oct 1 '11 at 0:23

2 Answers 2

If you use Firefox: install HTTPS Everywhere. It has a list of sites that support SSL, and will make sure the browser always connects to them over SSL-encrypted https (never over unencrypted http).

(If you are really concerned about security, you could also add NoScript. However, this is likely to be difficult for the average end user to use, so I don't recommend it, if this is for general-purpose use..)

I am not so sure about the other behaviors you want to be enforced. I am concerned that they may "break the web": they may cause many web sites not to work. That might be problematic. If people find that their browser does not work for many sites they care about, there is a significant likelihood they will change to a different browser if they can (or curse the IT department, if they can't). In any case, regardless of desirability, I do not have pre-packaged software that does what you want; you will probably need to build your own extension.

share|improve this answer
    
Ideally I would like to have these "break the web" settings apply to a specific DNS domain... one that is made to operate with these restrictions. Thanks for the ideas BTW –  makerofthings7 Oct 1 '11 at 7:02

HTTP Strict Transport Security (HSTS), a feature introduced by Chrome (http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) is a nice move towards security against MITM.

Other options you mention would be sure to break many sites. Requiring secure-flag cookies for instance (and thus ignoring those without?) would break a lot of sites, as would ignoring 302's.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.