17

Do browsers have a list with sites that are supposed to be encrypted?

Could a man in the middle attack be performed by presenting a user a http site instead of an https site? That way the server would not need to provide a certificate.

It wouldn't show up as a secure site in the browser but I think most people wouldn't notice it. And it wouldn't warn the user, because there are legitemate sites which don't use https.

Would such an attack be possible or does the browser notice that the site is supposed to use https but doesn't?

Improve this question
0

2 Answers 2

Reset to default
31

The short answer: they know a very limited number.

HTTP Strict Transport Security was introduced to provide better guarantees that a website is being served over HTTPS when specified by the operator.

This works well for websites you have visited recently as your browser will remember their HSTS policy and refuse a plaintext connection.

For example, if you visit your (previous visited from home) bank's website from an untrusted network that happens to have a man in the middle attempting to downgrade the connection to plain HTTP, your browser will refuse to connect because it remembers the website's security policy.

If you have not visited the site previously, the man in the middle needs to not only downgrade the connection security, but also remove the HSTS header (Strict-Transport-Security) from the response. This isn't difficult.

The problem you have identified is the major limitation: what happens if you are the victim of a downgrade attack during the first visit.

One solution browsers have implemented is to package a "pre-loaded HSTS list" of popular websites known to require HTTPS. Obviously this cannot be comprehensive and even with the list, attackers can still setup security downgrade proxies at slightly related DNS names.

You can submit a domain for inclusion in the HSTS Preload List at hstspreload.org.

Improve this answer
15
  • 3
    This doesn't check if something is in the list, just whether it can be added. Here's how to query the list: play.golang.org/p/jc6AO1SpWWz (you'll need to run this locally, the Go playground doesn't do networking)
    – Marc
    Jul 31, 2020 at 14:58
  • 4
    The entry is: {Name:google.com Mode: IncludeSubDomains:true}
    – Marc
    Jul 31, 2020 at 14:59
  • 3
    @kelalaka is right. google.com is not preloaded you can go to chrome://net-internals/#hsts and query domains and see that gmail.com and mail.google.com are preloaded while google.com is not. The entry cited: {Name:google.com Mode: IncludeSubDomains:true} is for includesubdomains
    – mcgyver5
    Jul 31, 2020 at 15:06
  • 1
    Has there ever been a proposal for an HSTS-equivalent DNS record? Then the browser could find out if https is required before issuing any HTTP request at all.
    – Ross Presser
    Jul 31, 2020 at 20:48
  • 1
    Ah, this presentation talks about that.
    – Ross Presser
    Jul 31, 2020 at 20:49
16

Security researcher Moxie Marlinspike demonstrated this type of attack in 2009, using a tool that he created called 'sslstrip'. See https://www.youtube.com/watch?v=ibF36Yyeehw (beginning at about 8:34).

To prevent this type of attack, we now have HTTP Strict Transport Security (HSTS). Sites can include an HSTS header in their response, to inform browsers to always connect to the site by HTTPS in the future. Upon receiving the HSTS response header from the site, the browser adds the site to an 'HTTPS-only' list that it maintains, so that going forward, the browser will only connect to that site by HTTPS. So, with a site that has implemented HSTS, an sslstrip attack may succeed on the first connection to the site, but HSTS prevents an sslstrip attack on subsequent connections.

To prevent an sslstrip attack on the first connection to the site, the site operator can include the site on an HSTS preload list. HSTS preload lists are shipped with some browsers (e.g. Chrome), so that the browser knows to connect to these sites by HTTPS-only, even before connecting for the first time.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .