Public Key Pinning Being Removed from Chrome
groups.google.com
Public Key Pinning Being Removed from Chrome
1–10 of 111 posts
Re: Public Key Pinning Being Removed from Chrome
#2This is especially funny to me as our PCI DSS Network Scan just started flagging not having a HPKP Header as something thats necessary to remediate. I've had to waste half a day on the phone and then to write a Risk Mitigation Plan that explains how we mitigate the risk of an MITM Attack in case our CA gets breached...
Re: Public Key Pinning Being Removed from Chrome
#3This is especially funny to me as our PCI DSS Network Scan just started flagging not having a HPKP Header as something thats necessary to remediate. I've had to waste half a day on the phone and then to write a Risk Mitigation Plan that explains how we mitigate the risk of an MITM Attack in case our CA gets breached...
... isn't the risk that HPKP mitigates the risk of a MITM attack in case some other CA gets breached?
Re: Public Key Pinning Being Removed from Chrome
#4This is especially funny to me as our PCI DSS Network Scan just started flagging not having a HPKP Header as something thats necessary to remediate. I've had to waste half a day on the phone and then to write a Risk Mitigation Plan that explains how we mitigate the risk of an MITM Attack in case our CA gets breached...
[deleted]
Re: Public Key Pinning Being Removed from Chrome
#5Interesting HN-discussion about the future of HPKP from a little over a year ago [1]. Reading it, I think this move was predictable.
The article suggests the Expect-CT header as a safer alternative. Scott Helme has a short but informative write-up how this works[2].
[1] https://news.ycombinator.com/item?id=12434585
[2] https://scotthelme.co.uk/a-new-security-header-expect-ct/
Re: Public Key Pinning Being Removed from Chrome
#6This is especially funny to me as our PCI DSS Network Scan just started flagging not having a HPKP Header as something thats necessary to remediate. I've had to waste half a day on the phone and then to write a Risk Mitigation Plan that explains how we mitigate the risk of an MITM Attack in case our CA gets breached...
... isn't the risk that HPKP mitigates the risk of a MITM attack in case some other CA gets breached?
HPKP also protects against your CA if you pin the direct private keys your servers use, but I bet it also is quite annoying to come up with a good plan for how you are not going to loose/delete all the private keys you have pinned...
Re: Public Key Pinning Being Removed from Chrome
#7Interesting HN-discussion about the future of HPKP from a little over a year ago [1]. Reading it, I think this move was predictable. The article suggests the Expect-CT header as a safer alternative. Scott Helme has a short but informative write-up how this works[2]. [1] https://news.ycombinator.com/item?id=12434585 [2] https://scotthelme.co.uk/a-new-security-header-expect-ct/
Crikeys. By that point the damage is done. How about a read-CAA-via-DNSSEC-and-confirm-that-it's-the-right-CA header?
(The certificate could embed a DNSSEC assertion about the CAA header or lack thereof, for that matter.)
Re: Public Key Pinning Being Removed from Chrome
#8Earlier quoted context omitted.
... isn't the risk that HPKP mitigates the risk of a MITM attack in case some other CA gets breached?
HPKP also protects against your CA if you pin the direct private keys your servers use, but I bet it also is quite annoying to come up with a good plan for how you are not going to loose/delete all the private keys you have pinned...
Right. I'm curious which approach the auditors wanted - either one would be a weird thing to mandate!
In theory, pinning your servers' private keys is actually kind of reasonable, if you generate like two or three sets of backup private keys and put them in off-site storage. And I've long been an advocate of buying at least one backup certificate from another CA just in case your current one gets distrusted.
(And it makes sense from a technical perspective why HPKP supports both of these approaches, but the ambiguity probably didn't help it from a policy perspective).
Re: Public Key Pinning Being Removed from Chrome
#9Good riddance. It had low adoption and pales in comparison to what will be achieved with Certificate Transparency.
DNS redirect attacks (common/easy due to social engr) combined with malicious HPKP could result in some nasty ransoming ("many of your users can't access your site unless you pay me for the key"). I've heard many surprised it hasn't happened yet. Particularly considering the lack of recourse options for victims.
Re: Public Key Pinning Being Removed from Chrome
#10What about supporting client side certificates in HTTP2?