News for hackers. Stuff that matters.

A comment on Key Reinstallation Attacks – Breaking WPA2 by Forcing Nonce Reuse. Parent comment

Re:Key Reinstallation Attacks – Breaking WPA2 by Forcing Non... by pfg on Monday October 16, 2017 @08:53AM (#15482821)
Perfect is the enemy of good. A large portion of sensitive traffic is protected by HSTS today, and the preload list compresses well. By the time it'll become a problem, we'll hopefully be at the stage where HTTP is treated as insecure anyway.

I'm not certain if uninstalling a browser clears the cache (do uninstalled browsers retain their profiles?), but preloaded sites would not be affected - they're included in the browser binary. Either way, let's not act like there's a massive hole in HSTS because there's a possibility that users might go as far as reinstalling their browser to visit a not-preloaded HSTS-enabled site that's being targeted.

[ Parent | on HN ]
Re:Key Reinstallation Attacks – Breaking WPA2 by Forcing Non... by peterwwillis on Monday October 16, 2017 @10:59AM (#15483640)
I'm not saying it's a massive hole, i'm saying it's an easily preventable hole that the entire industry is ignoring for unknown reasons. One simple URI change could make HSTS obsolete and fix the hole with no need for awkward workarounds and half-measures. Nobody has yet explained to me why "good enough" is better than "fixed".
[ Parent | on HN ]