Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Already on GitHub? Sign in to your account

add HSTS preload requirement for wallets #1277

Merged
merged 2 commits into from Dec 21, 2016

Conversation

Projects
None yet
5 participants
Contributor

jameshilliard commented Apr 9, 2016 edited

Requiring HSTS preloading reduces the risk of MITM attacks for users who have not previously visited a particular site before and is especially useful for preventing downgrade attacks on TOR users or users who use browsers without persistent storage. bitcoin.org itself currently doesn't use HSTS preloading and it would be a good idea to enable it there as well.

Contributor

jameshilliard commented Apr 9, 2016

Some of the web wallets listed already enable this:
Coinbase: enabled
Bitgo: enabled
Coinapult: enabled
Coinkite: not enabled
Greenaddress: not enabled
Xapo: not enabled
Circle: not enabled

Contributor

Cobra-Bitcoin commented Apr 20, 2016

Thanks for bringing this to my attention. I'll look into enabling HSTS preloading for bitcoin.org (we should at least do it ourselves before making it a requirement for any wallets).

Contributor

crwatkins commented Jul 9, 2016

I think this is a good idea and I believe that it continues our (sometimes tedious) HSTS campaign which is a good thing. Thank you very much for submitting it, and thanks for reviewing the existing listings.

In the past, when we have introduced new requirements that some of our existing listings did not meet, we have placed them in our optional criteria section, strongly encouraging the criteria for new listings and requesting that existing listings update their offerings. A good example is that we initially introduced address rotation as optional and then moved it to required. It may be interesting to note that in that case, we did not list any new wallets that did not meet the criteria while it was it was in the optional section.

@jameshilliard, I would recommend moving the new preload criteria to the optional section for the time being and later upgrade it to required. This will allow us to officially recommend it to our existing listings while giving them adequate time to research the implementation and any possible implications.

Contributor

jameshilliard commented Aug 18, 2016

@Cobra-Bitcoin Any update on getting HSTS preloading enabled for bitcoin.org in light of this?

@wbnns wbnns self-assigned this Dec 9, 2016

@jameshilliard HSTS is now enabled for Bitcoin.org - thank you for mentioning this. Other than the one change to the location of requirement you proposed, everything LGTM.

README.md
@@ -719,7 +719,7 @@ Basic requirements:
- No concerning bug is found when testing the wallet
- Website supports HTTPS and 301 redirects HTTP requests
- SSL certificate passes [Qualys SSL Labs SSL test](https://www.ssllabs.com/ssltest/)
-- Website serving executable code or requiring authentication uses HSTS with a max-age of at least 180 days
+- Website serving executable code or requiring authentication uses HSTS with a max-age of at least 180 days and is included in the [HSTS preload list](https://hstspreload.appspot.com/)
@wbnns

wbnns Dec 16, 2016

Contributor

@jameshilliard Hey, sorry that this PR hasn't been resolved just yet. Can you please move this to the Optional section as per the comment @crwatkins left?

Contributor

jameshilliard commented Dec 16, 2016

@wbnns I've moved HSTS preloading to the optional section

Contributor

crwatkins commented Dec 16, 2016

Thanks @jameshilliard. LGTM.

Contributor

wbnns commented Dec 17, 2016

Unless others object, this will be merged on Wednesday, December 21st.

@jameshilliard Thank you, sir!

@wbnns wbnns merged commit 6f8e9c1 into bitcoin-dot-org:master Dec 21, 2016

1 check passed

continuous-integration/travis-ci/pr The Travis CI build passed
Details

yobit.net/616237DA21EBA3E38E881B48A837A374/USD/EUR/BTC/btc:mqEtAAMmdeFT9SUpeQAKiUDVamtrjz4M5M/btc:16WqpqGg6A1aH5J9auLUF6Ljt9AveLUxCu?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment