News for hackers. Stuff that matters.

A comment on Hijack of Amazon’s domain service used to reroute web traffic for two hours. Parent comment

Re:Hijack of Amazon’s domain service used to reroute web tra... by mehrdadn on Tuesday April 24, 2018 @05:28PM (#16916793)
> HSTS just means use HTTPS. It doesn't validate the previous cert. That is HPKP which almost nobody uses unless they control the client, such as mobile apps.

I thought HPKP is TOFU, not (necessarily?) preloaded? Meaning you don't need to control the client for the client to be able to take advantage of it?

[ Parent | on HN ]
Re:Hijack of Amazon’s domain service used to reroute web tra... by coverband on Tuesday April 24, 2018 @07:11PM (#16917483)
(For those like me who may not be familiar with the acronym, TOFU = Trust On First Use)
[ Parent | on HN ]
Re:Hijack of Amazon’s domain service used to reroute web tra... by LinuxBender on Tuesday April 24, 2018 @05:49PM (#16916964)
This came up when the root servers for .io were hijacked. It's really the same problem. Short of monitoring for such anomalies, the only saving grace would be HPKP which is just too risky to use outside of mobile apps. Why the attackers in this case didn't get valid certs, I have no idea. It takes seconds to get a wildcard now.
[ Parent | on HN ]
Re:Hijack of Amazon’s domain service used to reroute web tra... by SahAssar on Tuesday April 24, 2018 @05:42PM (#16916898)
HPKP can be either TOFU or preloaded. Google maintains a preload list that is included with Chrome, Firefox, Opera, Safari, IE 11 and Edge, but that is not a scalable solution for the future.
[ Parent | on HN ]
Re:Hijack of Amazon’s domain service used to reroute web tra... by rocqua on Tuesday April 24, 2018 @05:37PM (#16916854)
There might be a small preload list for HPKP. I'm pretty sure google uses key-pinning on their domains on chrome. Not sure if they use HPKP for that though.
[ Parent | on HN ]
Re:Hijack of Amazon’s domain service used to reroute web tra... by NickNameNick on Wednesday April 25, 2018 @08:30AM (#16920890)
I think chrome now ignores HPKP headers, and only respects the pre-load list. The risk of someone hijacking a domain, and inserting a malicious HKPK header had become too high.
[ Parent | on HN ]