Namecoin Forum

phelix wrote:Is this obsolete now with the new TLS implementation or not?

biolizard89 wrote:

phelix wrote:Is this obsolete now with the new TLS implementation or not?

It is not obsolete; even with the TLS implementation a user could forget to type "https" and be subject to an sslstrip attack. I think the proposal outlined in the original post should still be adopted.

khal wrote:It is an interesting feature that will have even more value in namecoin (if you use a proxy like Convergence for example), because the proxy can block the http request (locally) or redirect to https and no clear request has gone through internet at all.

I would like to rename "fingerprint" to "sha1" too (because other checksums can be used for more reliability [firefox displays also the md5, huhu]), and put this in a "https" record.

Something like this :

Code: Select all

{
  "ip": "xx.xx.xx.xx",
  "https":
  {
    "sha1": "xx:xx:xx:xx:xx:xx.../xxxxxxxxxxxx...",
    "enforce": "self/*",
  }
}

Applicability

The most important security vulnerability that HSTS can fix is SSL-stripping man-in-the-middle attacks, first introduced by Moxie Marlinspike in his 2009 BlackHat Federal talk "New Tricks For Defeating SSL In Practice."[16] The SSL stripping attack works (on both SSL and TLS) by transparently converting a secure HTTPS connection into a plain HTTP connection. The user can see that the connection is insecure, but crucially there is no way of knowing whether the connection should be secure. Many websites do not use TLS/SSL, therefore there is no way of knowing (without prior knowledge) whether the use of plain HTTP is due to an attack, or simply because the website hasn't implemented TLS/SSL. Additionally, no warnings are presented to the user during the downgrade process, making the attack fairly subtle to all but the most vigilant. Marlinspike's sslstrip tool fully automates the attack.

HSTS addresses this problem[15] by informing the browser that connections to the site should always use TLS/SSL. The HSTS header can be stripped by the attacker if this is the user's first visit. The Chrome browser attempts to limit this problem by including a "pre-loaded" list of HSTS sites.[17] Unfortunately this solution cannot scale to include all websites on the internet; a potential solution might be achieved by using DNS records to declare HSTS Policy, and accessing them securely via DNSSEC, optionally with certificate fingerprints to ensure validity (although DNSSEC will have secure last mile issues for the foreseeable future[18]).[19] HSTS can also help to prevent having one's cookie-based website login credentials stolen by widely available tools such as Firesheep.[20]