Re:Thai government to MITM all internet communications
by pcl on Monday May 30, 2016 @02:12PM
(#11802389)
Do those bypasses apply for HSTS-preloaded certs as well? My understanding is that the intention of HSTS preloading is to address this sort of attack, but haven't dug through the browser code to see what's happening in standard distributions.
[ Parent
| on HN ]
Re:Thai government to MITM all internet communications
by ikeboy on Monday May 30, 2016 @02:25PM
(#11802432)
Yes. It's explicitly not part of their threat model: https://www.chromium.org/Home/chromium-security/security-faq...
Re:Thai government to MITM all internet communications
by niij on Monday May 30, 2016 @02:59PM
(#11802552)
If you have a Root Cert installed on your system, and they are MITMing traffic to a HSTS site with that Cert then your browser will give no warnings (for HSTS or non-HSTS sites).
Re:Thai government to MITM all internet communications
by gruez on Monday May 30, 2016 @02:28PM
(#11802442)
The point of HSTS (and preloading) is to protect clients from sslstrip (and similar attacks). as in, client types in a http url, and the attacker prevents the http connection from being upgraded.
Re:Thai government to MITM all internet communications
by pcl on Monday May 30, 2016 @03:01PM
(#11802558)
That's one of the goals of HSTS itself, but preloading designed to allow secure-only communications when establishing a connection to a hitherto-unused site, so that MITM attacks can't simply provide their own certs on first connect.