search

bifurcation / expect-ct

A specification for Expect-CT
6 stars 3 forks source link

Fill in Security and Privacy Considerations sections #14

Closed jcjones closed 7 years ago

jcjones commented 7 years ago

These are all the considerations from my notes, as well as a few more that I've dreamed up.

The first commit also updates the README a bit.

jcjones commented 7 years ago

I've reviewed all of your comments, and thought through privacy considerations some more, taking more ideas from RFC7469. One I didn't resolve was about the super-cookie consideration: I'm not (yet) able to convince myself of how that would work, so I'm not sure how to write it up.

The HPKP super-cookie is dependent upon two things: 1) The ease of setting pins that aren't checked at "note time" 2) {less important} Cascading set pins to subdomains

Expect-CT doesn't have an equivalent to setting unchecked pins, and nor does it have includeSubDomains. So it seems to be to produce a super-cookie scenario one would need to:

1) Set up X tracking websites, each in a good Expect-CT state and emitting Expect-CT headers 2) Compel clients to Note a unique subset of those X tracking websites, Y where Y ⊂ X. 3) Reconfigure a subset Z of those X tracking websites to violate CT policy where Z ⊂ X. 4) Compel clients to connect to all of those X tracking websites and use the resulting failure list to derive the client's identity.

This seems to be much harder than providing unique report-uri values to each client and prompting a failure... but I'm probably missing something obvious!

I'll be happy to talk through the attack a bit more and take another try at it, maybe in a different PR.

estark37 commented 7 years ago

Yeah, I was thinking about the unique-subset-of-noted-subdomains thing (e.g. http://www.leviathansecurity.com/blog/the-double-edged-sword-of-hsts-persistence-and-privacy/), which I thought was in both HPKP and HSTS RFCs, but I guess I was mistaken because I don't see it in either of them!

I still think it might be worth including but agree that it can be done in a different PR.

estark37 commented 7 years ago

This PR lgtm, just have to figure out what's going on with the circleci check...

estark37 commented 7 years ago

@bifurcation do you have any idea what's up with the circleci check?

bifurcation commented 7 years ago

@estark37 I don't see a CircleCI build for it (??) The main thing CircleCI checks is that the document builds, so if you can do that locally, it's probably safe to just merge.

estark37 commented 7 years ago

@bifurcation I don't seem to be able to merge (either manually or in the github UI) without the CircleCI check passing.

jcjones commented 7 years ago

I've committed an amend and forced an update; it looks like CircleCI passed this time. @estark37