Proton

Summary of HSTS Support in Modern Browsers

HTTP Strict Transport Security (HSTS) is a web security policy that is made to protect secure HTTPS websites against downgrade attacks that is used to perform Man in the middle attacks. “Once a supported browser receives this header that browser will prevent any communications from being sent over HTTP to the specified domain and will instead send all communications over HTTPS. It also prevents HTTPS click through prompts on browsers”[1].

HSTS support

The downgrade attack can occur when the user request a website in HTTP. When the user requested in HTTP:// URL, the server redirects the user to a secure HTTPS:// URL. Without HSTS, an attacker in the same network is able to stop the user from using the HTTPS version of the site and forcing the user to use the HTTP version, where the attacker is able to control user’s data and hijack the user’s session.

The HTTPS stripping attack that relates to the unuse of HSTS policy can be done via open-source tools, such as SSLStrip by Moxie Marlinspike. The tool has been publicly released on February 2009, and since then many browsers and websites have mitigated the issue.

Preventing the issue should be from two sides: the website, and the client. The website has that is already using HTTPS should apply HSTS policy to prevent the attack. The client has to use an updated version that supports HSTS policy.

The current advisory is tend to inform users that there is still modern browsers that do not support HSTS policy until today.

The following browsers supports HSTS policy (latest versions of browsers):

  • Google Chrome
  • Mozilla Firefox
  • Microsoft Edge
  • Safari for OSX
  • Opera
  • Ghostery
  • TOR Browser

The following browsers do not support HSTS policy:

  • Internet Explorer (all stable versions do not support HSTS. Only Microsoft Edge and Internet Explorer 10 Technical Preview support it)
  • Android Browser ( All versions upto 4.4.2 do not support HSTS policy. Newer versions might not be supporting it too)
  • Opera Mini (all versions, including Opera Mini 8)
  • Maxthon browser
  • UC browsers (including UC browser, UC mini, UC browser HD)
  • Opera for Android

Testing Browsers for MITM attacks due to Lack of HSTS policy:

You can follow the instructions in the following link to check if the browser supports HSTS policy.

http(yeni pencere)://(yeni pencere)www(yeni pencere).(yeni pencere)thoughtcrime(yeni pencere).(yeni pencere)org(yeni pencere)/(yeni pencere)software(yeni pencere)/(yeni pencere)sslstrip(yeni pencere)/(yeni pencere)

Recommendations:

  • Always use the latest version of browsers
  • If you are concerned about your security, do not use a browser that does not support HSTS policy.
  • If you are using a browser that is not listed above, you should test if it supports HSTS policy, and if it does not support it, you should stop using it.

Notes:

  • Even if the website is using the maximum SSL encryption possible, if the client’s browser does not support HSTS, the client is vulnerable to man in the middle attacks.
  • If the client made an initial request to the website in HTTP, an attacker can manipulate the response to uninclude the HSTS header, and would be able to perform MITM attacks too. Therefore, if you are making an initial request to secured site, you should request it in HTTPS to avoid HTTPS stripping that leads to MITM attacks.

The list might be updated for newer information. If there is a mistake on the list, you can contact me to correct it.

References:

http(yeni pencere)://(yeni pencere)en(yeni pencere).(yeni pencere)wikipedia(yeni pencere).(yeni pencere)org(yeni pencere)/(yeni pencere)wiki(yeni pencere)/(yeni pencere)HTTP(yeni pencere)_(yeni pencere)Strict(yeni pencere)_(yeni pencere)Transport(yeni pencere)_(yeni pencere)Security(yeni pencere) [1]

http(yeni pencere)://(yeni pencere)caniuse(yeni pencere).(yeni pencere)com(yeni pencere)/#(yeni pencere)feat(yeni pencere)=(yeni pencere)stricttransportsecurity(yeni pencere)

https(yeni pencere)://(yeni pencere)www(yeni pencere).(yeni pencere)owasp(yeni pencere).(yeni pencere)org(yeni pencere)/(yeni pencere)index(yeni pencere).(yeni pencere)php(yeni pencere)/(yeni pencere)HTTP(yeni pencere)_(yeni pencere)Strict(yeni pencere)_(yeni pencere)Transport(yeni pencere)_(yeni pencere)Security(yeni pencere)

http(yeni pencere)://(yeni pencere)blogs(yeni pencere).(yeni pencere)msdn(yeni pencere).(yeni pencere)com(yeni pencere)/(yeni pencere)b(yeni pencere)/(yeni pencere)ie(yeni pencere)/(yeni pencere)archive(yeni pencere)/2015/02/16/(yeni pencere)http(yeni pencere)(yeni pencere)strict(yeni pencere)(yeni pencere)transport(yeni pencere)(yeni pencere)security(yeni pencere)(yeni pencere)comes(yeni pencere)(yeni pencere)to(yeni pencere)(yeni pencere)internet(yeni pencere)(yeni pencere)explorer(yeni pencere).(yeni pencere)aspx(yeni pencere)

https(yeni pencere)://(yeni pencere)developer(yeni pencere).(yeni pencere)mozilla(yeni pencere).(yeni pencere)org(yeni pencere)/(yeni pencere)en(yeni pencere)(yeni pencere)US(yeni pencere)/(yeni pencere)docs(yeni pencere)/(yeni pencere)Web(yeni pencere)/(yeni pencere)Security(yeni pencere)/(yeni pencere)HTTP(yeni pencere)_(yeni pencere)strict(yeni pencere)_(yeni pencere)transport(yeni pencere)_(yeni pencere)security(yeni pencere)

http(yeni pencere)://(yeni pencere)www(yeni pencere).(yeni pencere)chromium(yeni pencere).(yeni pencere)org(yeni pencere)/(yeni pencere)hsts(yeni pencere)

http(yeni pencere)://(yeni pencere)www(yeni pencere).(yeni pencere)thoughtcrime(yeni pencere).(yeni pencere)org(yeni pencere)/(yeni pencere)software(yeni pencere)/(yeni pencere)sslstrip(yeni pencere)/
(yeni pencere)

About the Author

Mazin Ahmed is an information security specialist with experience in web-application security and mobile application security. Mazin is passionate about information security and has reported vulnerabilities which have been acknowledged by various companies, such as Facebook, Twitter, Linkedin, and Oracle to name a few. Mazin is part of Proton Mail’s security group, an independent panel of experts who audit Proton Mail releases on a voluntary basis. You can reach him via Twitter @mazen160(yeni pencere), and read more about him by visiting his website(yeni pencere).

İlgili makaleler

A cover image for a blog about how to create an incident response plan that shows a desktop computer and a laptop with warning signs on their screens
en
Do you have an incident response plan to protect your business from financial and reputational damage? Find out how Proton Pass for Business can help you stay safe.
Shared with me in Proton Drive for desktop user interface
en
  • Kurumlar için
  • Ürün güncellemeleri
  • Proton Drive
We've improved Proton Drive for Windows to make it easier to securely collaborate with others from your desktop.
Smart glasses that have been modified for facial surveillance and dox you in real time, finding your personal information after seeing your face.
en
Students modified smart glasses to find someone’s personal data after just looking at them. This is why we must minimize data collection.
The cover image for a blog explaining what password encryption is and how Proton Pass helps users with no tech experience benefit from it
en
Password encryption sounds complicated, but anyone can benefit from it. We explain what it is and how it’s built into Proton Pass for everyone to use.
How Proton can help with DORA compliance
en
We look at how DORA will affect your organization and how Proton’s services can help you meet its compliance requirements.
en
We searched the dark web for Spanish and Italian politicians’ official email addresses. Compared to other politicians, they’ve had fewer breaches.