Subject: [websec] default value for max-age ? (was: Re: Strict-Transport-Security syntax redux)

From: =JeffH <[email-masked]>
Date: Mon, 02 Jan 2012 15:29:20 -0800

Julian wondered..
 >
 > wouldn't it make sense to have a default for max-age so it
 > can be made OPTIONAL?

hm ... I lean towards keeping max-age as REQUIRED (without a default value) and 
thus hopefully encouraging deployers to think a bit about this and its 
ramifications, and also because its value is so site-specific in terms of a web 
application's needs, deployment approach, and tolerance for downside risk of 
breaking itself.

=JeffH

---

From: Chris Palmer <[email-masked]>
Date: Mon, 2 Jan 2012 16:35:00 -0800

On Mon, Jan 2, 2012 at 3:29 PM, =JeffH <[email-masked]> wrote:

> hm ... I lean towards keeping max-age as REQUIRED (without a default value)
> and thus hopefully encouraging deployers to think a bit about this and its
> ramifications, and also because its value is so site-specific in terms of a
> web application's needs, deployment approach, and tolerance for downside
> risk of breaking itself.

I feel the same way for public key pinning, for the same reason.

---

From: Adam Barth <[email-masked]>
Date: Mon, 2 Jan 2012 16:50:48 -0800

> web application's needs, deployment approach, and tolerance for downside

Makes sense to me.  Chrome currently ignores the header if the server
doesn't specify a max-age.

Adam

---

From: Yoav Nir <[email-masked]>
Date: Tue, 3 Jan 2012 08:26:36 +0200

> application's needs, deployment approach, and tolerance for downside risk of 

I tend to agree, but it's not deployers who are going to do the thinking - it's the implementers of web servers. 

So somewhere, in some control panel for IIS, or a config file for Apache, or some WebUI for some SSL-VPN, there's going to be a configuration to turn on HSTS, and that product is going to have a default max-age. The deployers are just going to check the box.

I think we should provide guidance for those implementers as to what is a good default there.

Yoav

---

From: Julian Reschke <[email-masked]>
Date: Tue, 03 Jan 2012 09:20:08 +0100

On 2012-01-03 01:50, Adam Barth wrote:
> On Mon, Jan 2, 2012 at 3:29 PM, =JeffH<[email-masked]>  wrote:
>> Julian wondered..
>>>

Understood. I just wanted to make sure that the simplification was 
considered.

> doesn't specify a max-age.

Well yes, the spec says that it's invalid.

Best regards, Julian

---

From: Julian Reschke <[email-masked]>
Date: Tue, 03 Jan 2012 09:22:18 +0100

On 2012-01-03 07:26, Yoav Nir wrote:
> ...

If we know a good default then it should be the default on the wire 
(IMHO). It would help getting predictable behavior when it's missing. 
(Right now the spec allows recipients to do anything they want then it's 
missing, right?)

Best regards, Julian

---

From: Adam Barth <[email-masked]>
Date: Tue, 3 Jan 2012 01:14:42 -0800

On Tue, Jan 3, 2012 at 12:22 AM, Julian Reschke <[email-masked]> wrote:
>> So somewhere, in some control panel for IIS, or a config file for Apache,
>> or some WebUI for some SSL-VPN, there's going to be a configuration to turn
>> on HSTS, and that product is going to have a default max-age. The deployers
>> are just going to check the box.
>>
> If we know a good default then it should be the default on the wire (IMHO).
> It would help getting predictable behavior when it's missing. (Right now the
> spec allows recipients to do anything they want then it's missing, right?)

We should define the behavior in any case, which I guess means I'm
advocating an default max-age of zero.

Adam

---

From: Julian Reschke <[email-masked]>
Date: Tue, 03 Jan 2012 10:59:47 +0100

> advocating an default max-age of zero.

That sounds good to me; so the grammar wouldn't need to enforce this, 
but the effect would be the same.

Best regards, Julian

---

From: Tobias Gondrom <[email-masked]>
Date: Wed, 04 Jan 2012 10:05:22 +0000

On 03/01/12 08:22, Julian Reschke wrote:
>> I tend to agree, but it's not deployers who are going to do the 
>> thinking - it's the implementers of web servers.
>>
>> So somewhere, in some control panel for IIS, or a config file for 
>> Apache, or some WebUI for some SSL-VPN, there's going to be a 
>> configuration to turn on HSTS, and that product is going to have a 
>> default max-age. The deployers are just going to check the box.
>>
> (Right now the spec allows recipients to do anything they want then 
> it's missing, right?)
>
> Best regards, Julian
>

<hat="individual">
well, the optimal default may actually be depending on the host.
So we might want to describe what good values might be under which 
circumstances.
E.g. long time-spans when using very trusted process and provider, 
shorter time-spans with less capable / higher risk of bricking yourself 
/ loosing your private key / ...

Thinking about the idea default of max-age = 0: AFAIK this would be 
equivalent to it being disabled, correct? (Not sure I'd like that: 
imagine in an Admin GUI you enable HSTS/Cert Pinning and then don't set 
the max-age and have basically disabled it....)
On the other hand I believe the optimal value would be host specific, 
and therefore there SHOULD NOT be a global default value !=0. :-(
(=> Thereby vanishing myself in a puff of logic...)

Best regards, Tobias