HSTS Fingerprinting #13437

jumde · 2018-03-13T23:52:28Z

Test Plan:

Open Brave. Disable HTTPS Everywhere in preferences.
Open safebrowsing-proxy.brave.com (ping @jumde if the domain is not working)
Verify that the ninja image is loaded with a 301 redirect even if the page is loaded multiple times.
Clear browsing history (to avoid cached responses)
Load https://avatars2.githubusercontent.com/u/1903815?s=40&v=4 in the URL bar
Open safebrowsing-proxy.brave.com and confirm that the HTTPS upgrade happens with a 307 redirect instead of 301.

Alternative test plan if proxy site is not working

repeat steps above, but replace safebrowsing-proxy.com with https://jsfiddle.net/pqwdgr5x/5/

diracdeltas · 2018-03-13T23:56:45Z

app/filtering.js

@@ -364,6 +364,12 @@ function registerForHeadersReceived (session, partition) {
      muonCb({ cancel: true })
      return
    }
+
+    if (firstPartyUrl !== details.url) {


please use isThirdPartyHost instead on the URL hostnames since we want to check this based on the host, not the full URL

codecov-io · 2018-03-14T00:18:37Z

Codecov Report

Merging #13437 into master will increase coverage by 0.33%.
The diff coverage is 45.45%.

@@            Coverage Diff             @@
##           master   #13437      +/-   ##
==========================================
+ Coverage   56.25%   56.59%   +0.33%     
==========================================
  Files         283      284       +1     
  Lines       28353    28764     +411     
  Branches     4674     4749      +75     
==========================================
+ Hits        15950    16278     +328     
- Misses      12403    12486      +83

Flag	Coverage Δ
#unittest	`56.59% <45.45%> (+0.33%)`	⬆️

Impacted Files	Coverage Δ
app/sessionStore.js	`88.4% <100%> (+0.2%)`	⬆️
app/filtering.js	`17.64% <25%> (-0.36%)`	⬇️
js/lib/color.js	`19.04% <0%> (-4.49%)`	⬇️
js/lib/appUrlUtil.js	`84.66% <0%> (-1.88%)`	⬇️
app/browser/reducers/historyReducer.js	`97.81% <0%> (-1.35%)`	⬇️
app/browser/api/ledgerNotifications.js	`69.87% <0%> (-1.08%)`	⬇️
...r/components/preferences/payment/enabledContent.js	`74.76% <0%> (-0.59%)`	⬇️
app/renderer/components/tabs/content/tabTitle.js	`44.44% <0%> (-0.46%)`	⬇️
js/actions/appActions.js	`18.59% <0%> (-0.11%)`	⬇️
js/contextMenus.js	`18.43% <0%> (-0.09%)`	⬇️
... and 27 more

diracdeltas · 2018-03-14T18:06:29Z

app/filtering.js

+
+    let parsedTargetUrl = urlParse(details.url || '')
+    let parsedFirstPartyUrl = urlParse(firstPartyUrl)
+    let trackingHeaders = ['Strict-Transport-Security', 'Expect-CT', 'Public-Key-Pins']


these should be const not let

minor: rename trackingHeaders to something like trackableSecurityHeaders so it's more clear why we are deleting them

i think these should also include https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Public-Key-Pins-Report-Only

diracdeltas · 2018-03-14T18:10:40Z

app/filtering.js

+    if (isThirdPartyHost(parsedFirstPartyUrl.hostname, parsedTargetUrl.hostname)) {
+      trackingHeaders.forEach(function (header) {
+        delete details.responseHeaders[header]
+        delete details.responseHeaders[header.toLowerCase()]


this line shouldn't be needed because details.responseHeaders capitalization is already normalized

I checked yesterday, and I did see some headers in lowercase. Strict-Transport-Security and strict-transport-security

thanks for checking - i think i was confused because Cookie and Referer have only a single capitalization mode, but that's because they are request headers not response headers

this seems potentially problematic because HTTP headers are case-insensitive according to the RFC. so someone could create a header called sTriCT-TransPort-SecUrITY and the browser would still process it (in theory)

diracdeltas · 2018-03-14T18:20:35Z

app/filtering.js

+  for (let partition in registeredSessions) {
+    let ses = registeredSessions[partition]
+    setImmediate(() => {
+      ses.clearHSTSData.bind(ses)(() => {})


i think this should just be ses.clearHSTSData.bind(ses)() since clearHSTSData doesn't take a callback. (or even just ses.clearHSTSData() - not sure why the bind is necessary)

diracdeltas · 2018-03-15T00:00:53Z

lgtm. will test after brave/muon#532 is released

bsclifton · 2018-03-26T17:41:29Z

@diracdeltas this is now ready for review, as Muon code was merged. We don't have a new Muon build yet- so if you'd like to try that out, we'll have to wait for it to finish

diracdeltas · 2018-03-27T19:38:47Z

Awesome work. Here is the test plan I did:

edit session-store-1, make sure lastAppVersion is less than 0.22.x (if not, edit it)
in a new tab, visit https://avatars3.githubusercontent.com/u/7602755?v=4
now go to https://jsfiddle.net/pqwdgr5x/3/. the URLbar should show an unlocked icon.

diracdeltas

verified working on muon 5.1.2

HSTS Fingerprinting

bsclifton · 2018-03-27T20:22:58Z

master 09e515f
0.23.x d8fa1f1
0.22.x 0a049dd

Revert "Merge pull request #13437 from brave/hsts-fingerprinting"

lint

8fd9fce

NejcZdovc assigned jumde Mar 13, 2018

NejcZdovc added security privacy labels Mar 13, 2018

diracdeltas reviewed Mar 13, 2018

View reviewed changes

jumde added 7 commits March 13, 2018 18:20

update

2d95a75

lint

4b6f90a

lint

1f71cee

lint

e582571

lint

a399cb9

compare hosts not urls

3a8d985

compare hosts not urls

27ba205

diracdeltas reviewed Mar 14, 2018

View reviewed changes

diracdeltas added this to the 0.22.x (Developer Channel) milestone Mar 14, 2018

jumde added 5 commits March 14, 2018 11:40

update per comments

c40994b

update

3a2640b

added tests for HSTS data cleanup

6b40aa7

lint

0d90ece

easy tests

97ab150

diracdeltas added the PR/blocked label Mar 15, 2018

jumde mentioned this pull request Mar 15, 2018

HSTS Fingerprinting brave/muon#527

Closed

update

96c4fad

jumde removed the PR/blocked label Mar 22, 2018

diracdeltas approved these changes Mar 27, 2018

View reviewed changes

bsclifton merged commit 09e515f into master Mar 27, 2018

bsclifton deleted the hsts-fingerprinting branch March 27, 2018 20:19

bsclifton added a commit that referenced this pull request Mar 27, 2018

Merge pull request #13437 from brave/hsts-fingerprinting

d8fa1f1

HSTS Fingerprinting

bsclifton added a commit that referenced this pull request Mar 27, 2018

Merge pull request #13437 from brave/hsts-fingerprinting

0a049dd

HSTS Fingerprinting

diracdeltas mentioned this pull request Mar 27, 2018

mitigate HSTS fingerprinting #12223

Closed

bsclifton added a commit that referenced this pull request Mar 28, 2018

Merge pull request #13638 from bsclifton/revert-hsts

684e9e8

Revert "Merge pull request #13437 from brave/hsts-fingerprinting"

bsclifton added a commit that referenced this pull request Mar 28, 2018

Merge pull request #13638 from bsclifton/revert-hsts

6bf2547

Revert "Merge pull request #13437 from brave/hsts-fingerprinting"

bsclifton added a commit that referenced this pull request Mar 28, 2018

Merge pull request #13638 from bsclifton/revert-hsts

cf9ee27

Revert "Merge pull request #13437 from brave/hsts-fingerprinting"

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

HSTS Fingerprinting #13437

HSTS Fingerprinting #13437

jumde commented Mar 13, 2018 •

edited by diracdeltas

Loading

diracdeltas Mar 13, 2018

codecov-io commented Mar 14, 2018 •

edited

Loading

diracdeltas Mar 14, 2018

diracdeltas Mar 14, 2018

diracdeltas Mar 14, 2018

diracdeltas Mar 14, 2018

jumde Mar 14, 2018

diracdeltas Mar 14, 2018 •

edited

Loading

diracdeltas Mar 14, 2018

diracdeltas commented Mar 15, 2018

bsclifton commented Mar 26, 2018

diracdeltas commented Mar 27, 2018

diracdeltas left a comment

bsclifton commented Mar 27, 2018

HSTS Fingerprinting #13437

HSTS Fingerprinting #13437

Conversation

jumde commented Mar 13, 2018 • edited by diracdeltas Loading

Test Plan:

Alternative test plan if proxy site is not working

diracdeltas Mar 13, 2018

Choose a reason for hiding this comment

codecov-io commented Mar 14, 2018 • edited Loading

Codecov Report

diracdeltas Mar 14, 2018

Choose a reason for hiding this comment

diracdeltas Mar 14, 2018

Choose a reason for hiding this comment

diracdeltas Mar 14, 2018

Choose a reason for hiding this comment

diracdeltas Mar 14, 2018

Choose a reason for hiding this comment

jumde Mar 14, 2018

Choose a reason for hiding this comment

diracdeltas Mar 14, 2018 • edited Loading

Choose a reason for hiding this comment

diracdeltas Mar 14, 2018

Choose a reason for hiding this comment

diracdeltas commented Mar 15, 2018

bsclifton commented Mar 26, 2018

diracdeltas commented Mar 27, 2018

diracdeltas left a comment

Choose a reason for hiding this comment

bsclifton commented Mar 27, 2018

jumde commented Mar 13, 2018 •

edited by diracdeltas

Loading

codecov-io commented Mar 14, 2018 •

edited

Loading

diracdeltas Mar 14, 2018 •

edited

Loading