Slashdot Mirror

← Back to Stories (view on slashdot.org)

Internet Explorer 11 Gains HTTP Strict Transport Security In Windows 7 and 8.1

Posted by Soulskill on from the teaching-an-old-dog-new-tricks dept.

Mark Wilson writes: Anyone using the Windows 10 preview has had a chance to use the HTTP Strict Transport Security (HSTS) in Microsoft Edge, and today the security feature comes to Internet Explorer 11 in Windows 7 and Windows 8.1. This security protocol protects against man-in-the-middle attacks and is being delivered to users of older version of Windows through an update in the form of KB 3058515.

56 comments

  1. Security by Dunbal · · Score: 3, Funny

    You'll be safe. Trust Microsoft. They know about security. When they promise it, they promise it.

    --
    Seven puppies were harmed during the making of this post.
    1. Re:Security by Whiteox · · Score: 1

      Phew! I was getting worried after reading their new EULAs. Thankfully you've assuaged my fears.

      --
      Don't be apathetic. Procrastinate!
    2. Re:Security by Anonymous Coward · · Score: 2, Insightful

      Why does /. even bother posting Microsoft stories? It just brings out the cynical doomsayers who still live like it's 1995.

      Funny how after all that fear-mongering it ended up being Apple who is dominating personal computing with drab gray/black/white computers, tablets and phones where everybody has the same in a 1984-style.

    3. Re:Security by Opportunist · · Score: 5, Funny

      Oh for fuck's sake, at least read up on HSTS before you reach for the knee-jerk reaction to karma whore.

      Li'l hint: Karma whoring only works by saying what you think the groupthink will agree with if you manage to not look like a complete moron in the process. Like, say, by showing off that you know exactly zero about the topic at hand.

      A more sensible Karma whoring on the topic would be "Oh great, MS finally woke up and implemented what everyone else already had at the very least a year ago. And that qualifies as news on Slashdot these days, when MS implements something everyone else already has?". There you have MS bashing and /. bashing rolled into a single posting. Guaranteed to give you more up-mods than you could ever need.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    4. Re:Security by CaptainDork · · Score: 2

      Is up mods a goal?

      --
      It little behooves the best of us to comment on the rest of us.
    5. Re:Security by Anonymous Coward · · Score: 0

      space grey / silver / gold, thank you very much!

    6. Re:Security by __aaclcg7560 · · Score: 2

      Funny how after all that fear-mongering it ended up being Apple who is dominating personal computing with drab gray/black/white computers, tablets and phones where everybody has the same in a 1984-style.

      The 1980's and 1990's were dominated by PCs that came in one color and one color only: beige. If you don't like the current monochromatic regime, visit an Apple Store to see the new color scheme of gold, silver and space gray.

    7. Re:Security by mitcheli · · Score: 3, Interesting

      Why does /. even bother posting Microsoft stories? It just brings out the cynical doomsayers who still live like it's 1995.

      As a Microsoft Doomsayer, I'm not immune from jumping on this article to predict the future of how new zero day's will result in the mass pwning of Grandma's computers everywhere. That being said, I'm not blind to the fact that Apple is gaining an increased market share and that as time goes on, they will become an increasingly targeted platform as the profitability (be it in information or money) increases. Microsoft does have what appears to be a more responsive patch process than Apple. Apple is very slow at responding to reported exploits (albeit, Microsoft has been known to half-ass patch and to sit on patches as well). In any case, my biggest issue with this report is I'm curious how much community involvement Microsoft had with the development of this new protocol. In the past, they just create crap in-house without the involvement of industry partners (sometimes even closing them out of those conversations). The problem with this is there is less industry oversight on potential weaknesses and less input on modifications that can strengthen the underlying protocol. Protocols in particular are not something that needs to be developed by a small team of engineers without support of the industry as a whole, less you get protocols like SMTP (who's author is on record of apologizing profusely for not building in security). So, as a Microsoft doomsayer, I shall sit back and wait with my "I told you so" in my back pocket. In the meantime, IE/Edge/whatever the hell they want to call it can stay off my computer thank you very much.

      --
      Select from tblFriends where interesting >= 4;
    8. Re:Security by sasparillascott · · Score: 3, Funny

      You're totally right AC. Microsoft is definitely someone consumers can trust with their security:

      http://www.theguardian.com/world/2013/jul/11/microsoft-nsa-collaboration-user-data

  2. I can hardly wait! by timrod · · Score: 4, Funny

    I, for one, welcome this change to Internet Explorer. Now, I can know I am truly safe from man-in-the-middle attacks the next time I load a fresh Windows install and open IE10 so I can download Firefox.

    1. Re:I can hardly wait! by timrod · · Score: 0

      IE11. I was going to say IE11.

    2. Re:I can hardly wait! by TechyImmigrant · · Score: 1, Informative

      What makes you think Firefox is safe from MITM attacks?

      --
      I should use this sig to advertise my book ISBN-13 : 978-1501515132.
    3. Re:I can hardly wait! by pushing-robot · · Score: 4, Interesting

      To be fair, a web browser download would be a great opportunity for a MITM attack.

      --
      How can I believe you when you tell me what I don't want to hear?
    4. Re:I can hardly wait! by Anonymous Coward · · Score: 0

      To be fair, a web browser download would be a great opportunity for a MITM attack.

      You devious little creature. You're a bad boy.

    5. Re:I can hardly wait! by Anonymous Coward · · Score: 0

      If you're going to troll, make the effort to do it right.

    6. Re:I can hardly wait! by Opportunist · · Score: 4, Informative

      Funny enough, due to how HSTS works, exactly the security of this connect will NOT be improved.

      For HSTS to work, you need to have visited a page before. Because the server sets a token that tells your browser that in the next X days/months/years, it should connect to this server using https, and https only. This means if you type in http://whateverpage.com/ it will automatically turn it into a https connection and the browser will not allow a connection if something is fishy, e.g. when the certificate is bogus.

      For this to work, though, your browser must already know that the server supports this. So you must have had visited that page at least once.

      For the single time you use IE to download anothther browser, HSTS won't do you any good. But maybe you find comfort in the fact that your browser already has supported HSTS for quite a while now (IIRC about 4 years or so...).

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    7. Re:I can hardly wait! by Opportunist · · Score: 4, Interesting

      Possibly that they have had HSTS support for about 4 years now...

      It ain't foolproof, though, and with MS not supporting it 'til now it wasn't really that widely used (the server has to support it to work).

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    8. Re:I can hardly wait! by Antique+Geekmeister · · Score: 0

      Install CygWin and use wget, instead. The CygWin installer fits easily on a USB stick.

    9. Re:I can hardly wait! by thegarbz · · Score: 1

      Browsers (at least Chrome and FireFox) also have a handful of sites "whitelisted" by HSTS so that they will only connect EVER with SSL; facebook, google, etc...

      I'm sure that courtesy does not extend to https://www.getfirefox.com/

    10. Re:I can hardly wait! by rtb61 · · Score: 0

      Perhaps M$ was hoping to be the MITM with it's OS and thus HSTS was not in it's interests but with Android and OS X making deep inroads into internet communications, being the MITM became unrealistic. So if M$ can't play no one else should be able to. Of course corrupt ISPs seem destined to seek MITM roles in order to inflate profits for as long as they can get away with it. ISPs can always try to force the installation of specific MITM software in order to use their network, this until such time as specific legislation prohibits that attempt and of course how far that legislation extends to other players including the Android and Apple marketplace.

      --
      Chaos - everything, everywhere, everywhen
    11. Re:I can hardly wait! by blavallee · · Score: 1, Redundant

      You forgot a step. ..load a fresh Windows install, open IE, deal with the security settings for your profile, then download Firefox.

      That's why I load a fresh Windows install, open the command prompt, FTP to ftp.mozilla.org, and download Firefox.

    12. Re:I can hardly wait! by cbhacking · · Score: 3, Interesting

      On the one hand, you're kind of wrong; any site that wants to can opt into the HSTS preload list, and IE uses the same preload list that both Chrome, Safari, and Firefox use. The preload list, by the way, is not a "whitelist" in the usual sense; it simply has the effect of there having been a "zeroth visit" before the first visit, so the first visit is safe. After that, the site behaves as normal.

      On the other hand, it is true that getfirefox.com doesn't support HSTS at all (much less appear in the preload list, which would reject it anyhow for failing to have the response header present). Worse, though, mozilla.org doesn't seem to support it! At least, the Chrome dev tools don't list the Strict-Transport-Security header in responses from the site. That is a bizarre (and, frankly, unwise) omission.

      --
      There's no place I could be, since I've found Serenity...
    13. Re:I can hardly wait! by thegarbz · · Score: 1

      I'm actually not that surprised. Supporting HSTS is a pre-requisite for getting and A+ rating on things like SSLLabs, and when we look at the kind of results that have come through that site and how well SSL in general has been managed then everyone should be shedding tears.

      Your first reaction may be "no excuse" but there is a gotchya here, if sites that provide downloads to browsers need to support SSL then they also need to cater for the lowest common denominator, so IE6 based on the list of Windows XP machines still in the wild. That opens up a whole world of insecure ciphers from what I recall. But in general I don't expect these sites to have the latest and greatest world class security.

    14. Re:I can hardly wait! by Bacon+Bits · · Score: 2

      Cygwin is the worst answer to pretty much any issue on Windows ever. Forcing a POSIX environment onto the Windows environment to do basic tasks is why Linux admins are so shit at administering Windows. Just learn the damn system you're using.

      If you need to have a script saved, just use PowerShell:

      Invoke-WebRequest -Uri 'ftp://ftp.mozilla.org/pub/firefox/releases/38.0.5/win32/en-US/Firefox Setup 38.0.5.exe' -OutFile 'C:\Firefox Setup 38.0.5.exe'

      If you really want you can parse the output from http://download.cdn.mozilla.ne..., but that seems like a huge waste of time. Just fetch a reasonably recent version and plan to update twice.

      Otherwise, just use ftp.exe.

      --
      The road to tyranny has always been paved with claims of necessity.
    15. Re:I can hardly wait! by Opportunist · · Score: 1

      It hurts the head to read such a load of baloney.

      But let's imagine MS was out to MITM everyone. Just for kicks. How would HSTS affect that? They run the show on most desktop PCs. If they WANT to listen to communication it's trivial to them. When you essentially control the WHOLE FRIGGIN' SYSTEM why bother trying to bug the browser? Especially if it's trivial for the user to replace this part while it's near impossible for them to replace the whole underlying OS, let alone do a complete security audit of it.

      What the fuck should HSTS change in this?

      I really don't mind people hating MS. Or Apple. Or Google for that matter. But mixing in some harebrained conspiracy theories bordering on insanity into it doesn't really help the case. Especially not if anyone with at least a HINT of knowledge in the relevant field can debunk your muddleheaded rambling for what it is.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    16. Re:I can hardly wait! by rtb61 · · Score: 1

      As the supplier, you can only ever do what your customers allow you to do. Deny history all you want, M$ has a terrible track record http://en.wikipedia.org/wiki/C....

      --
      Chaos - everything, everywhere, everywhen
    17. Re:I can hardly wait! by Opportunist · · Score: 1

      I'm halfway certain that MS won't whitelist the servers of its competitors. Then again, considering that whitelisting doesn't accomplish anything but forcing the browser to use HTTPS and the distinct possibility that some ancient and not updated boxes running Windows might not be able to handle the encryption provided (with RC4 pretty much being the black sheep now and anything before TLS being insecure by design), MS just might whitelist them knowing that an outdated version of Windows is maybe not capable of handling a HTTPS connection to them.

      Would be funny to check. Then again, if there are still people insane enough to connect an out-of-the-box, pre-SP, version of Vista to the net, HSTS and HTTPS enforcing is their least concern.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    18. Re:I can hardly wait! by Opportunist · · Score: 1

      That's pretty odd considering Firefox was one of the first browsers to support HSTS.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    19. Re:I can hardly wait! by Opportunist · · Score: 1

      Hen and egg.

      At one hand of course getting a browser should be done on a secure connection considering the amount of personal data entrusted to this program (and the program by design having to be able to access that data). On the other hand, getting it with an outdated browser might not allow for tight security. The bare minimum today is pretty much TLS 1.1, which is by some years younger than XP and was released after IE 6 met its EOL. RC4 is "outlawed" as a cipher in TLS now, which makes it kinda difficult for fresh XP installations to find cipher or protocol to communicate on.

      Then again, when you use XP on the internet today, security is very obviously none of your concerns.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    20. Re:I can hardly wait! by Opportunist · · Score: 1

      MS doesn't give half a shit about its customers. Twice so for consumer customers. No question about that.

      But seriously, if they WANT to spy on you, they CAN. No need to fuck around on the network traffic when you control EVERYTHING on the machine.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
  3. Trust by Anonymous Coward · · Score: 0

    Do they really think they can protect against man in the middle? Once your shit leaves the door, who really knows what happens to it?
    Given the news lately, it seems we can make some reasonable predictions where this is going.

    No thanks.

    1. Re:Trust by mellon · · Score: 1

      Yes, they really think they can protect against an MiTM attack. Of course it's possible that the NSA in cahoots with the aliens has a quantum computer that can MiTM any SSL connection, but even if they do, it's probably sufficiently expensive that they won't do it for every connection, but just for high-value connections. And if not, we're pretty fucked, because a big chunk of the world economy at this point depends on the notion that it is not trivially easy to MiTM SSL connections.

  4. other options by Anonymous Coward · · Score: 4, Informative

    looks like internet explorer is behind

    From wikipedia:
    Browser support[edit]
    Chromium and Google Chrome since version 4.0.211.0[28][29]
    Firefox since version 4;[30] with Firefox 17, Mozilla integrates a list of websites supporting HSTS.[20]
    Opera since version 12[31]
    Safari as of OS X Mavericks[32]
    Internet Explorer 11 on Windows 8.1 and Windows 7 since June 2015[33]
    Microsoft Edge and Internet Explorer 11 on Windows 10 Technical Preview support HSTS.[34][35]

    1. Re:other options by mellon · · Score: 1

      Yup. I installed HSTS on my web site last week, and it worked a treat with both Chrome and Safari. I have to admit that I didn't test MSIE, due to a fundamental lack of Windows on my home network.

    2. Re:other options by ron_ivi · · Score: 1

      I have to admit that I didn't test MSIE, due to a fundamental lack of Windows on my home network.

      SSL Labs has a website will test HSTS on various IE versions for you: https://www.ssllabs.com/ssltes...

  5. About time by Anonymous Coward · · Score: 0

    Better late than never

  6. Re:You're joking, right? by Anonymous Coward · · Score: 0

    Sorry, I don't use Microsoft products on the Internet, but thanks anyway.

    That's not true. While your browser might not be from MS, I suspect you use quite a few IIS hosted sites.

  7. trollin', trollin', trollin' by turkeydance · · Score: 1, Funny

    keep them doggies Edgin', IE!

  8. Comment removed by account_deleted · · Score: 4, Informative

    Comment removed based on user account deletion

  9. Please support TLS-SRP in IE11 as well by WaffleMonster · · Score: 0

    Dear Microsoft,

    Please let us establish secure connections using TLS-SRP in IE11. This would be most helpful. Imagine a world where even people with weak passwords (most everyone) fooled into supplying credentials to a phisher or MITM attacker face no risk for being suckers.

    Apache and some of our Intranet applications support TLS-SRP already yet unfortunately usage is currently limited to machine to machine as none of our users have a browser that can negotiate it. This would be a perfect opportunity to get a leg up on your competition and provide an important security features no other browser vendor has yet to deploy.

    1. Re:Please support TLS-SRP in IE11 as well by cbhacking · · Score: 1

      SRP has a number of problems, the most notable being that there's no way to securely *distribute* (or create) the password without falling back to some other TLS suite, or doing it out of band. This really limits the usefulness of SRP in a browser.

      Additionally, I'm not sure how browser support for SRP is supposed to make phishing stop working. If the user still needs to enter their password somewhere, then the phishing attack just has to look like wherever they usually enter their password. Yes, an attacker intercepting the network traffic of a legitimate handshake won't be able to extract any useful info about the password (or be able to replay it blindly), but a phishing site that gets users to enter their password and then sends that password back to the (attacker's) server via whatever mechanism it cares to will still work just fine.

      On the other hand, there are definitely places that I'd like to see SRP deployed. A key one, which I consider a lot more important than in browsers, would be as a replacement for NTLM hashes (which are antique and terrible) in SMB (Windows networking, Samba, etc.) traffic. It also makes sense for things like remote desktop or ssh (where, at least for password auth, you assume that both sides already know the password so the distribution problem is taken care of). Once you have it in those places, putting it in the browser seems reasonable enough - after all, enterprises do use IE's built-in support for NTLM auth to web servers, which sucks about as much as NTLM for SMB - but I'd put the other areas ahead of the browser.

      --
      There's no place I could be, since I've found Serenity...
    2. Re:Please support TLS-SRP in IE11 as well by WaffleMonster · · Score: 1

      SRP has a number of problems, the most

      The biggest issues I am aware of is the mostly worthless notion of protecting stored passwords by irreversibly hashing passwords changes.

      While stolen SRP verifiers (equivalent of a password hash) can't be used to login to a legitimate system they can like password hashes be used to conduct brute force attacks and they can also be used to trick individuals into thinking they are connecting to a legitimate service. This is equivalent to theft of private key or subversion of CA infrastructure.

      The other problem is when PKI is not used with SRP the authenticating identity is transmitted in the clear which may give away information (e.g. a username or alias) to an eavesdropper users may not want disclosed in the clear.

      notable being that there's no way to securely *distribute* (or create) the password without falling back to some other TLS suite, or doing it out of band. This really limits the usefulness of SRP in a browser.

      Saying that bootstrapping trust is SRPs problem is like saying distributing trusted certificates is PKIs problem.

      At some point you need to do work to create trust relationships.. This is fundamentally unavoidable reality the same way people in the real world come to trust or not other individuals based on their experiences.

      I do NOT believe SRP is a replacement for PKI. They each have their roles and I believe they can and should be used concurrently. PKI is obviously much better suited for initial service discovery on the Internet. Yet the reality is most sites worth protecting with TLS require a login of some kind. Everyone has a login for their email accounts, their banks and their facebooks... What I find unacceptably dangerous is the world continuing to ignore individual trust relationships to secure sessions... because the alternative is asking hundreds of redundant global trust anchors to be responsible for the security of the worlds systems...a laughably insane delusion.

      Additionally, I'm not sure how browser support for SRP is supposed to make phishing stop working. If the user still needs to enter their password somewhere, then the phishing attack just has to look like wherever they usually enter their password.

      It becomes tractable to educate users to enter their passwords only into a specific browser menu rather than random attacker forms which appear to be indistinguishable from legitimate counterparts which are constantly subject to change, redesign and often contain baseless security assertions (such as fake padlock imagery and baselessly reassuring text)

      On the other hand, there are definitely places that I'd like to see SRP deployed. A key one, which I consider a lot more important than in browsers, would be as a replacement for NTLM hashes

      NTLMV2 and Kerberos Authentication both need to be replaced with a modern secure authentication system however a lot more people login to websites using pre-established usernames and passwords than they do a network file share. Many of them have no training and believe whatever they see on their screens because even legitimate sites spew lies to cover for fundamentally indefensible reality where insecure authentication is tolerated.

  10. Re:You're joking, right? by Anonymous Coward · · Score: 0

    Sorry, I don't take consider comments from holier-than thou bigots on the Internet, but thanks anyway.

  11. Oh Great by thegarbz · · Score: 5, Funny

    Oh great, MS finally woke up and implemented what everyone else already had at the very least a year ago.
    Also how low has Slashdot fallen that we now qualify MS getting something that everyone else already has as "news"?

    1. Re:Oh Great by Opportunist · · Score: 4, Funny

      I couldn't have said it better. Oh if only I had modpoints...

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    2. Re:Oh Great by thegarbz · · Score: 1

      Now if only +5 funny counted towards karam :-)

    3. Re:Oh Great by Opportunist · · Score: 1

      Oh c'mon, karma whoring on /. is easier than shooting fish in a barrel. All you have to do is twist any discussion towards something anti-MS or anti-government and you'll be modded up to cap.

      You should be wary with postings about Apple or some political agenda. Then you should first check which fraction of the groupthink userbase currently has the modpoints. But reading a posting or two above the one you want to reply to should give you the necessary information.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    4. Re:Oh Great by thegarbz · · Score: 1

      It used to be even easier than that. For a while you could say what you wanted and as long as you signed it off with Fuck Beta you got modded up. Ahhh the bad old days :-)

  12. Update for IE6 by ArhcAngel · · Score: 0

    Did Microsoft happen to mention when the KB would be rolled out for IE6?

    --
    "A person is smart. People are dumb, panicky dangerous animals and you know it." - K
    1. Re:Update for IE6 by cbhacking · · Score: 1

      Well, MS isn't always the fastest on rolling out security features. Somebody else may need to lead the way. If the Mozilla foundation releases HSTS for Firefox 1.0, it might be possible to persuade MS to do the same for their similarly-aged browser...

      --
      There's no place I could be, since I've found Serenity...
    2. Re:Update for IE6 by Anonymous Coward · · Score: 0

      IE6 shouldn't get anything. It needs to DIAF.

    3. Re:Update for IE6 by Anonymous Coward · · Score: 0

      Even the AC trolls can't tell when being trolled. /. is well and truly ded.

  13. Scan for malicious files without MitM? by hipsterdufus · · Score: 3, Informative

    While man-in-the-middle SSL connections sound like something everyone should be against, those in the corporate environment rely on using an in-line scanner to check for malicious/virus files going in/out the corporate environment. Those entities need to be able to block/report on where those file originated and their final destination. To do that, they rely on the scanning device being the SSL endpoint in order to decrypt and inspect the content. I would hope that this ability will be configurable via AD policy to allow the corporate MitM certificate to be considered trusted; however, there are an increasing number of sites that have javascript which verifies the SSL connection and checks that there is no MitM SSL occuring. While it sounds safe, it actually HELPS virus/malware authors if browsers block MitM connections to ssl sites.

    An SSL cert is like $5 from Comodo, so if all browsers checked for MitM connections and prevented access, then corporations can't protect their networks from content on an SSL connection and would have to trust all content from the interwebs.

    There are security ramifications to increased security.

  14. Comment removed by account_deleted · · Score: 1

    Comment removed based on user account deletion