Security advisory: Breach and Django

Re:Security advisory: Breach and Django by antihero on Tuesday August 06, 2013 @11:45AM (#6167225)

Except we can set the cookie because we're already doing that to HTTPS requests via cookie-forcing.

[ Parent | on HN ]

Re:Security advisory: Breach and Django by donaldstufft on Tuesday August 06, 2013 @12:08PM (#6167374)

I've just woken up and I haven't tested it, but off the cuff I believe HSTS will prevent the browser from trusting a plaintext HTTP response at all. So you cannot force a cookie if I understand the blog post correctly. You'd have to create a cookie inside of a verifiable HTTPS connection, which if you can do you've already executed a much worse attack.

[ Parent | on HN ]

Re:Security advisory: Breach and Django by antihero on Tuesday August 06, 2013 @12:31PM (#6167541)

I think this is what it hinges on:

http://scarybeastsecurity.blogspot.com.es/2008/11/cookie-for...

Is that possible under HSTS?

[ Parent | on HN ]

Re:Security advisory: Breach and Django by homakov on Tuesday August 06, 2013 @12:16PM (#6167430)

> but off the cuff I believe HSTS will prevent the browser from trusting a plaintext HTTP response at all

Cookies are broken (i write about it on my blog like, daily). The essential idea of Forcing is injecting cookies into HTTPS space from HTTP.

[ Parent | on HN ]

Re:Security advisory: Breach and Django by donaldstufft on Tuesday August 06, 2013 @12:23PM (#6167487)

@homakov, so you can get a browser to trust a cookie from a HTTP response under a domain protected by HSTS?

[ Parent | on HN ]

Re:Security advisory: Breach and Django by antihero on Wednesday August 07, 2013 @03:03AM (#6171284)

Doesn't HSTS just mean that the browser will just always make HTTPS responses?

[ Parent | on HN ]