News for hackers. Stuff that matters.

A comment on 18yo arrested for reporting a bug in the new Budapest e-Ticket system. Parent comment

Re:18yo arrested for reporting a bug in the new Budapest e-T... by cpach on Sunday July 23, 2017 @11:54PM (#14835791)
See https://hstspreload.org
[ Parent | on HN ]
Re:18yo arrested for reporting a bug in the new Budapest e-T... by pmoriarty on Monday July 24, 2017 @12:04AM (#14835818)
Ok, so that works for Chrome, but every other application is still going to be subject to an MITM attack if their users try to connect via http?
[ Parent | on HN ]
Re:18yo arrested for reporting a bug in the new Budapest e-T... by lukegb on Monday July 24, 2017 @12:52AM (#14835962)
As long as the other application is Firefox, Safari, IE11/Edge, or Opera, then it probably has a HSTS preload list that is at least in part generated from the Chrome one.

Firefox have some scripts which go through and check to make sure everything still on the Chrome list is still announcing the preload headers, and will autoremove if that isn't that case, IIRC. I wouldn't be too shocked if Apple/Microsoft were doing something similar.

[ Parent | on HN ]
Re:18yo arrested for reporting a bug in the new Budapest e-T... by pmoriarty on Monday July 24, 2017 @01:33AM (#14836099)
"As long as the other application is Firefox, Safari, IE11/Edge, or Opera, then it probably has a HSTS preload list that is at least in part generated from the Chrome one."

Is there any documentation for these browsers that officially say exactly what they're doing and how their preload lists are generated?

[ Parent | on HN ]
Re:18yo arrested for reporting a bug in the new Budapest e-T... by kilotaras on Monday July 24, 2017 @07:22AM (#14837493)
Here's a firefox one

https://wiki.mozilla.org/SecurityEngineering/HTTP_Strict_Tra...

[ Parent | on HN ]