Hot answers tagged

7

No, a rewrite rule is still vulnerable to attacks like sslstrip. If you look at the documentation or try it out, you'll see that your rewrite rule is actually creating a redirect.


5

You've found already that this can be done with an extension like HTTPS Everywhere. And you've found out that the browser will not do this by default. Thus there is the option of "doing nothing with the browser", which doesn't provide the protection or the option of "doing something in the client" which is already a solved problem by installing a plugin. ...


4

I was able to disable it by setting network.stricttransportsecurity.preloadlist to false in about:config


4

Actually, this is already answered in stackoverflow : RFC 6797 Appendix A : HSTS doesn't work for IP address. You need to setup local DNS server to deal with it.


4

It's because some applications don't use the common HTTPS API from the SDK. Some of them implement their own libraries, and have their own keystores. In those apps, the certificate used for the connection is usually hard-coded, or the root certificate is hard-coded. In this cases, unless you modify the application to trust your certificate, installing user ...


3

every single page that doesn't have HSTS preload is vunerable to mitm attacks in first connection That's only true if you connect initially to the HTTP version of the website. If you manually add (or verify the presence of) https:// when going to the site, or if you use a browser extension like HTTPS Everywhere, you don't have to worry about being kept on ...


3

At least historically, the HSTS Preload site required that HTTP requests must redirect to HTTPS before doing anything else. As such, the order given in your second block is correct. In particular, the redirect to HTTPS must occur before any other redirects (such as to a www. subdomain, or expanding a shortened URL to its full form). Sending HSTS headers in ...


3

Public key pinning absolutely can prevent MITM even with a trusted CA certificate. The whole point of pinning is that the application knows exactly which certificate (hash, issuer, etc) to expect. Even though the trusted CA can generate a "valid" certificate for the domain, it won't be the exact certificate that the application is looking for, so it will ...


3

HSTS and HPKP are both for browsers, not generic mobile apps. Browsers that comply with the RFC can (and do) allow a connection with a manually trusted certificate despite HPKP. Mobile apps don't need to do this though, they don't even need to use HTTP. Certificate pinning in mobile apps is a similar idea to HPKP, but it's a different implementation.


2

If you are talking about Android devices, it's because in Android 7 and above, an app can choose whether to trust user-installed root certificates or not. They are just simply distrusting the cert you installed. If you can root your device, then you will be able to install your root into the system trust store, then the app would trust it.


2

Does the Facebook app use HSTS for Android/iOS? No. It doesn’t need to. HSTS is specific for telling web browsers like Chrome, Firefox, etc. to interact with their web service via HTTPS only. A mobile app will have HTTPS hard coded in the app itself making it the only option. I believe Apple requires this for any apps and for Android it looks like they are ...


1

SOCKS5 by itself just make sure that the necessary TCP connectivity to the target is created and that all data are forwarded between client and server. It also might do a DNS lookup to resolve the hostname. A plain SOCKS5 proxy does not change anything with the payloads or changes the requested target server which means that HSTS will continue to work the ...


1

Yes. You can see at https://hstspreload.org/ that it is a requirement to include subdomains: The includeSubDomains directive must be specified.


1

If I recall correctly, when HSTS preload was launched, it did not need to have subdomains included. Now, the requirements state : Serve all subdomains over HTTPS. In particular, you must support HTTPS for the www subdomain if a DNS record for that subdomain exists. Serve an HSTS header on the base domain for HTTPS requests: The max-age ...


1

Mixed content is not really related to HSTS. It happens whenever you embed unprotected content into a protected (HTTPS) site. To avoid the mixed content error you need to avoid serving mixed content in the first place, i.e. don't embed HTTP content into a HTTPS site. The preferred way is to embed the content from the original server with HTTPS. If this is ...


1

The reason to be careful with preload is the case for when you think all your sites have converted to HTTPS, but then it turns out marketing uses some CRM from 2005 that still runs over HTTP. When you turn on HSTS with includeSubdomains, their tool will no longer work. If you have a new domain you still have total control over it, and it is unlikely that ...


1

It's probably within the spec. The phrase is regularly changed, and it's not something you happen upon by chance. You have to know what you're looking for (e.g. google 'chrome hsts bypass'), which indicates that you're aware of the risk. The bar for using this is a lot higher than clicking 'Proceed', as it is not documented in the Error Message shown to the ...


1

Absolutely it is justified. The HSTS standard is strictly wrong, though its exact wording adds at least two caveats which clearly allow for various options, including such "hidden" features as a secret passphrase, or a command-line flag, or arguably even the ability to register a site/address/certificate/etc. as trusted. All it really disallows is the ...


1

If your scenario is that you've accidentally set HSTS on a site you're working on and need to clear it, "Forget about this site" does the trick.


1

static means browser (in this case Chrome) Preloaded HSTS sites dynamic means sites that got picked up "on the go" or added manually pkp stands for Public Key Pinning, which is since Chrome 69 deprecated spki_hashes stands for SubjectPublicKeyInfo hashes _include_subdomains mean whether to include subdomains in the request _observed is the UNIX time on ...


Only top voted, non community-wiki answers of a minimum length are eligible