Scott Helme

And EV is vulnerable to a fancy looking fax (remember them?) Do you really check your site has an EV every single time? Especially now browsers treat them the same? If not, how do you know someone hasn't got a DV certificate for this specific visit? Scott Helme has a thorough takedown of them, and that was 7 years ago when they were still a thing. https://scotthelme.co.uk/are-ev-certificates-worth-the-paper-theyre-wr…

HPKP was generally not recommended even when it was still around due to the danger of breaking your site. https://scotthelme.co.uk/im-giving-up-on-hpkp/

FWIW HN sets the Referrer-Policy header [1] to origin [2] and it seems most browsers maybe support it. [3] Perhaps some addons override it or maybe some bots ignore it. [1] - https://scotthelme.co.uk/a-new-security-header-referrer-policy/ [2] - https://securityheaders.com/?q=https%3A%2F%2Fnews.ycombinator.com%2F&a… [3] - https://caniuse.com/referrer-policy

Isn't CSRF basically dead after `SameSite=Lax` was made the default [1]? Also, magic links being valid upto certain time doesn't sound a serious vulnerability to me. If the hacker has access to person's email/browser, the game is already over. There could be valid reasons—UX-wise—for not making magic links invalidate on the first use. Ex, the user wants to login on phone with the same link. I am sorry, but the post sounds more like amateurs who love reporting things like this to companies, hoping one of them will fall for it and pay them a bounty. [1]: https://scotthelme.co.uk/csrf-is-really-dead/

The screen shot recommends short passwords with one each of upper/lower/numeric/special characters. This policy has never been good. I find it discouraging from a company offering security-related services. https://scotthelme.co.uk/content/images/2021/08/image-3.png

Note that Feature-Policy is being depreciated for Permissions-Policy, which follows a slightly different syntax: https://scotthelme.co.uk/goodbye-feature-policy-and-hello-permissions-… Content-Security-Policy is quite powerful, because it limits which origins (domains) that your page can load resources from. It can eliminate some security surprises. https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP

Great article. Somebody else mentioned Scott Helme, but didn't link to three of his amazing sites: https://securityheaders.com which checks important headers https://report-uri.com/ which allows sending CSP reports to to catch errors. It also has a CSP builder (among a bunch of tools) which is hugely helpful: https://report-uri.com/home/generate https://scotthelme.co.uk/ is his blog with a ton of info. It also has a cheat sheet for CSP: https://scotthelme.co.uk/csp-cheat-sheet/ (I might be a fan of the guy ha)

Scott Helme, a security researcher has an article on EV certificates and some of the issues with them in an article from December 2017 (https://scotthelme.co.uk/are-ev-certificates-worth-the-paper-theyre-wr… There was some discussion on this when it was originally submitted to HN at https://news.ycombinator.com/item?id=15850837. Adam Caudill also has some insight here: https://adamcaudill.com/2017/04/09/looking-value-ev-certificates/

I would recommend changing this link to the linked writeup by Scott Helme: https://scotthelme.co.uk/nomx-the-worlds-most-secure-communications-pr…

I recommend this guide when making a choice how to set up HPKP. - https://scotthelme.co.uk/guidance-on-setting-up-hpkp/

It's worth pointing out that you can replace the functionality of the X-Frame-Options header with Content-Security-Policy using the frame-ancestors directive if you want to: https://scotthelme.co.uk/csp-cheat-sheet/#frame-ancestors A world with opt-in to unsafe behaviour would be great, but a long way off I fear. Thanks for mentioning the header check service!

> But that's why I think the role of the CA should change so that the signatures actually gives some form of tangible trust that people can relate to. But this is a tough thing to do. The best way to do this would be to introduce a new type of certificate, that can be stapled onto web requests maybe (eg. a signature at the end of the http body), that isn't controlled or authenticated by any existing system. This would allow clients to implement this system based on merit and based on whether or not it solves problems and concerns these clients have. For example, if it's literally just EV certificate boogaloo[0], then Chrome can choose to not implement it. But when you try to force it onto people in the form of QWACs or what have you, and have it government-mandated, this goes against the theory of 'open source' standards being adopted because they're a good standard, and instead degrades user experience by forcing client vendors to implement them regardless of their flaws. 0: https://scotthelme.co.uk/the-power-to-revoke-lies-with-the-ca/

Browsers stopped showing the banner a couple of years ago[1-3], around the time of the Ian Carroll’s Stripe, Inc. of Kentucky demonstration[4]; maybe that was it? It caused a great outcry from CAs, and I would’ve normally been against a single-sided, mostly Google-driven change like this, but the discussion[5] shows, at least as I read it, that CAs are unwilling to clearly communicate that the EV “green bar” does not imply “trustworthy”, it just upgrades “you have been securely connected to satan.com”, an authenticated DNS name, to “you have been securely connected to Satan LLC”, an authenticated legal-entity name. And as Stripe, Inc., of Kentucky shows, it’s not clear this is an upgrade at all, because while the rules for domain uniqueness in the DNS are relatively (barring IDNA) straightforward and well-known, the rules for uniqueness for names of legal entities are complex and dependent on jurisdiction to such an extent that neither users nor even CAs can be reasonably expected to follow them all. (I think one discussion on the CA/Browser Forum list mentioned that—forget state-scoped legal names in the US Stripe case—Germany has township-scoped legal names, so jurisdictionOfIncorporation would literally have to record, and UAs to show, the address of a specific town hall in Germany. Sure you know which one it should be?) Even today you will find CA websites[6-8] proudly proclaiming “customers think the EV green bar means trustworthy” (and, presumably, if they don’t, you…

That permutation list is too comprehensive. In reality, the ciphersuite that is chosen is far more limited based on current best practices. For example, up until a few years ago, SHA1 was offered as an HMAC primitive, but no one ever used it. It is far more likely in practice that 3~5 RSA or ECC base PKI suites would comprise the majority of HTTPS sessions. EDIT: I found a 2018 survey of 1,000,000 websites and these were the top 10 ciphersuites, far from the quadrillion combos the OP computed. ECDHE-RSA-AES256-GCM-SHA384 147985 ECDHE-RSA-AES128-GCM-SHA256 127964 ECDHE-ECDSA-AES128-GCM-SHA256 41043 ECDHE-RSA-AES256-SHA384 15400 DHE-RSA-AES256-GCM-SHA384 4326 ECDHE-RSA-AES256-SHA 3231 DHE-RSA-AES256-SHA 2484 0000 2194 AES256-SHA 2113 AES128-SHA 1855 https://scotthelme.co.uk/alexa-top-1-million-analysis-february-2018/

Thank you for fleshing out the comparison between HSTS and encrypted email. I just have a couple of points to add. 1. For the avoidance of doubt, there is a proposed "HSTS for email", but it doesn't provide end-to-end encryption (so it's not particularly relevant here). The technology I'm talking about is MTA-STS,[0] as described in RFC 8461, which you probably already know about, but it might be new to other people. I'm not sure how different the dynamics are between the web and email, though. Surely there are more operators of web servers than email servers? Also, over 90% of the email client market is attributable to Google, Microsoft, Apple, and Yahoo! collectively.[1] That doesn't seem very different to the situation with browsers. 2. I think it's worth highlighting that if a user is shifted from HTTPS to HTTP, that may mean that their password (or session cookie) is being sent unencrypted to/through an attacker. Once the attacker has this, they can access all the details of a user's account, which, in the case of webmail or a forum, includes all previous messages and grants them the ability to send new messages as that user. That seems like a worse failure mode than just losing the privacy of a single message, and I think people are just as likely to die if you leak information about them over insecure email as over insecure HTTP. In both cases the threat model would assume that the adversary is recording everything, all the time. [0]…

I have been trying to explain the importance of HTTP headers to some younger/junior devs I am working with. I have noticed that headers are often considered to be 'too technical' or even 'old tech'. I'm going to recommend them to read this, but I do think I need to explain a couple of things that the article is not clear about: - Be sure that you understand the concept of HSTS! Simply copy/pasting the example from this article will completely break subdomains that are not HTTPS enabled and preloading will break it permanently. I wish the authors made that more clear. Don't use includesubdomains and preload unless you know what you are doing. Scott Helme also did a great article about this [0]. - CSP can be really hard to set up. For instance: if you include google analytics, you need to set a script-src and a img-src. The article does a good job of explaining you should use CSP monitoring (I recommend sentry), but it doesn't explain how deceptive it can be. You'll get tons of reports of CSP exceptions caused by browsers plugins that attempt to inject CSS or JS. You must learn to distinguish which errors you can fix, and which are out of your control. - Modern popular frontend frameworks will be broken by CSP as they rely heavily on injecting CSS (a concept known as JSS or 'styled components'). As these techniques are often adopted by less experienced devs, you'll see many 'solutions' on StackOverflow and Github that you should set unsafe-inline in your CSP. This is bad…

I agree that RansomPKP itself isn't that big a real-world concern (which was part of my point), but it did motivate the first wide discussions that I'd seen questioning whether HPKP should exist. The linked Qualys blog post / HN thread was shortly after our talk, which (along with our conversation with Scott Helme around that time) led to Scott's post "Using security features to do bad things"[1]. RansomPKP and related follow-ups are directly highlighted by Scott's recent post "I'm giving up on HPKP"[2] in which he announced his decision to remove HPKP from the Security Headers tool[3], and Scott himself is cited in this post by Chris Palmer. Note that I'm not suggesting that Scott himself is responsible for this, or that anything he's said has been in bad faith. My point is simply that my talk was one part of the chain of events that started the ball rolling on this conversation. I'm also not saying that RansomPKP / hostile pinning is the most important reason that people have for not liking HPKP — in this case Chris lists it as only one of three motivations. Clearly, the usability issues with its implementation have been a much bigger problem, which is what I would like to see serious attempts to improve on before throwing out all the work that's been done up until now. --- Edit: re: sleevi edit: the tweet you linked doesn't say anything about regretting the concept of TLS key pinning entirely, just that it's done as a header. I'll admit it's ambiguous, but that…

>You're forgetting that they had a charge for revocation, which was also automated. I did not forget that, I was just talking about the authentication and certificate issuance side. But though it didn't fall under the umbrella of authentication it is something that actually cost real money at that point. You misunderstood the situation and how revocation functioned in a way that's extremely important (since it's finally getting fixed but the improvements could use more widespread deployment). The original certificate revocation mechanisms, CRL and OCSP, are and always have been completely broken in terms of fundamental scaling and failure modes. Scott Helme just did an excellent summary on the situation and upcoming developments [1] which I strongly encourage you to read, but in essence due to the way they work seriously offering CRL/OCSP (as in, in a way that won't instantly die when someone breaths on it hard) services and adding certs to them requires significant distributed infrastructure, which has not always been cheap. They were bad approaches even with that though due to other practical failure modes that were beyond a CA's control anyway. Both stink to the point that many (most? all?) operating systems/applications/browsers just soft fail by default or even ignore them entirely. "Revocation" for the wider web has largely been a mirage. StartCom did in fact have an explainer about this at one point, and their position was reasonable. Other CAs hid the cost in large…

I'm surprised there's no mention of the SameSite cookie attribute, I'd consider that to be the modern CSRF protection and it's easy, just a cookie flag: https://scotthelme.co.uk/csrf-is-dead/ But I didn't know about the Sec-Fetch-Site header, good to know.

There are bits of a leaked text: https://scotthelme.co.uk/what-the-qwac/ The concerns are about a specific article (Article 45) that prevents browsers from removing government certificates even if they are found to be malicious - not the concept of a digital ID in general. Digital IDs can still be implemented without that requirement - the certificates just have to make sure they hold themselves to the standards that browsers require of them.

Scott Helme has leaked the secret text of Article 45! (scroll down) https://scotthelme.co.uk/what-the-qwac/

For other confused people, "EV" here is an Extended Validation certificate, and this has nothing to do with Electric Vehicles. The author's previous blog post is basically mandatory reading if you want to make any sense of this one: https://scotthelme.co.uk/looks-like-a-duck-swims-like-a-duck-qwacs-lik…

A post-mortem from the last similar change in 2021. https://scotthelme.co.uk/lets-encrypt-root-expiration-post-mortem/

You can, Scott Helme wrote some articles about this (I mention them at the end of my article): * https://scotthelme.co.uk/when-pwned-passwords-bloom/ * https://scotthelme.co.uk/sketchy-pwned-passwords/ – here he uses a count-min sketch to also store the frequency

Strides have been made in web security, check out the permissions policy[0] along with COOP and COEP[1]. [0] https://www.w3.org/TR/permissions-policy-1/ [1] https://scotthelme.co.uk/enabling-coop-and-coep-reports-on-report-uri/

> I don't trust the EU to handle encryption. Literally nowhere in the article it says that. The TL;DR is: "QWAC certificates will have to show the green banner" and maybe non-QWAC will have some kind of warning. The link on TFA is informative https://scotthelme.co.uk/looks-like-a-duck-swims-like-a-duck-qwacs-lik… (sounds like a CA lobbying for this crap) In the end I suspect browsers might revoke some QWAC certs if they feel they are invalid

- Daniel Lemire: https://lemire.me/blog/ - Andrew Lock: https://andrewlock.net/ - Steve Gordon: https://www.stevejgordon.co.uk/ - Scott Helme: https://scotthelme.co.uk/ - Phil Haack: http://haacked.com/

Yes, it will expire 20 mins from now: at exactly ############################## # Sep 30 14:01:15 2021 GMT ############################## Check yourself file "ca.crt" with openssl x509 -enddate -noout -in ca.crt Useful links: * https://blog.devgenius.io/rhel-centos-7-fix-for-lets-encrypt-change-8a… * https://www.openssl.org/blog/blog/2021/09/13/LetsEncryptRootCertExpire… * https://scotthelme.co.uk/lets-encrypt-old-root-expiration/ * the discussion in HN at https://hn.algolia.com/?dateRange=pastMonth&page=0&prefix=fals…

Even things like Extended Validation certificates have in the past shown themselves to be subject to relatively significant inaccuracies[1] if that's any sort of mixed comfort. [1]https://scotthelme.co.uk/extended-validation-not-so-extended/

Most browsers are stopping ocsp because of the privacy use and the triviality to block it. Did Chrome ever do it? That’s why CT came around. Some background for those unfamiliar. https://scotthelme.co.uk/revocation-is-broken/