<div dir="ltr"><div></div>I would like to see HSTS applied to "<a href="http://whois.arin.net">whois.arin.net</a>" that way if you successfully get to the secure version of the site from an HSTS supporting user agent then on you will be forced to use the secure version and won't accidentally (or because of an MITM attack) go to the insecure version in the future. However, if your user agent doesn't support HTTPS, should still be able to get to the insecure site. Therefore, the insecure site should not automatically redirect to the secure version of the site, as insecure access to <a href="http://whois.arin.net">whois.arin.net</a> should (maybe even must) be allowed.<br><br>Maybe a compromise would be to have well-known browser user agents presented with a warning banner that says you are accessing the site insecurely and secure access is available via a link provided. Then if the user decides to go to the secure site, they will get an HSTS policy if their browser supports it. Other user agents (presumably programs accessing the API) should not get the additional warning banner unless an encryption status warning flag can be added to the API.<br><br>I'll also note all links embedded in response pages seem to point to secure pages, even with an insecure query. Maybe the links provided to an insecure query should point to insecure pages.<br>Also, it seems that "<a href="https://whois.arin.net/">https://whois.arin.net/</a>" redirects you to "<a href="http://whois.arin.net/ui">http://whois.arin.net/ui</a>" the insecure site, that redirect should probably send you to "<a href="https://whois.arin.net/ui">https://whois.arin.net/ui</a>" instead, the secure site.<br><br>To summarize;<br>1. Insecure access to <a href="http://whois.arin.net">whois.arin.net</a> should (maybe even must) be maintained.<br>2. Secure access to <a href="http://whois.arin.net">whois.arin.net</a> should be augmented with HSTS policy to prevent MITM attacks for user agents that support HSTS.<br>3. Secure queries should provide secure responses, vice-versa, insecure quires should provide insecure responses.<br>4. Possibly a warning banner could be provided when accessing the insecure site with well-known browsers, allowing users to decide to use the secure site and possibly get HSTS protections in the future, but by their choice, not automatically.<br><br>Thanks<div><br><div class="gmail_extra"><div class="gmail_quote">On Fri, Mar 16, 2018 at 12:36 PM, Owen DeLong <span dir="ltr"><<a href="mailto:owen@delong.com">owen@delong.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word">I’m actually opposed to this.<div><br></div><div>First, whois lookups are a query against a public database. All information in the</div><div>database is currently public, so there is no possibility that the content of a whois</div><div>lookup is sensitive other than, perhaps, the person sending the query wishes their</div><div>query to be unknown. In that case, the person sending the query is fully empowered</div><div>to choose https if desired.</div><div><br></div><div>There is no reason to add SSL overhead to all queries just because.</div><div><br></div><div>Owen</div><div><br><div><br><blockquote type="cite"><div>Begin forwarded message:</div><br class="m_-6457816507657917201Apple-interchange-newline"><div style="margin-top:0px;margin-right:0px;margin-bottom:0px;margin-left:0px"><span style="font-family:-webkit-system-font,Helvetica Neue,Helvetica,sans-serif;color:rgba(0,0,0,1.0)"><b>From: </b></span><span style="font-family:-webkit-system-font,Helvetica Neue,Helvetica,sans-serif">ARIN <<a href="mailto:info@arin.net">info@arin.net</a>><br></span></div><div style="margin-top:0px;margin-right:0px;margin-bottom:0px;margin-left:0px"><span style="font-family:-webkit-system-font,Helvetica Neue,Helvetica,sans-serif;color:rgba(0,0,0,1.0)"><b>Subject: </b></span><span style="font-family:-webkit-system-font,Helvetica Neue,Helvetica,sans-serif"><b>[ARIN-Suggestions] NEW ACSP 2018.3: Automatically Redirect Whois Queries to Secure URL</b><br></span></div><div style="margin-top:0px;margin-right:0px;margin-bottom:0px;margin-left:0px"><span style="font-family:-webkit-system-font,Helvetica Neue,Helvetica,sans-serif;color:rgba(0,0,0,1.0)"><b>Date: </b></span><span style="font-family:-webkit-system-font,Helvetica Neue,Helvetica,sans-serif">March 16, 2018 at 10:02:16 PDT<br></span></div><div style="margin-top:0px;margin-right:0px;margin-bottom:0px;margin-left:0px"><span style="font-family:-webkit-system-font,Helvetica Neue,Helvetica,sans-serif;color:rgba(0,0,0,1.0)"><b>To: </b></span><span style="font-family:-webkit-system-font,Helvetica Neue,Helvetica,sans-serif"><a href="mailto:arin-suggestions@arin.net">arin-suggestions@arin.net</a><br></span></div><br><div><div>On 14 March 2018, we received a new ACSP 2018.3: Automatically Redirect<br>Whois Queries to Secure URL.<br><br><a href="https://www.arin.net/participate/acsp/suggestions/2018-3.html">https://www.arin.net/<wbr>participate/acsp/suggestions/<wbr>2018-3.html</a><br><br>Description: It appears possible to go to the insecure version of ARIN's<br>whois by going to <a href="http://whois.arin.net">http://whois.arin.net</a>. Would ARIN be willing<br>auto-redirect users to the secure version, <a href="https://whois.arin.net">https://whois.arin.net</a>, and<br>additionally, consider using HSTS for this site, too?<br><br>Value to Community: Secures all WHOIS lookups, which could sometimes be<br>potentially sensitive. It's also consistent with what ARIN has done with<br>most of it's other public-facing websites.<br><br>Timeframe: Not specified<br><br>**<br><br>We are currently evaluating this suggestion, and will provide a response<br>to the community as soon as it is available.<br><br><br>Regards,<br><br><br>Communications and Member Services<br>American Registry for Internet Numbers (ARIN)<br><br>______________________________<wbr>_________________<br>arin-suggestions mailing list<br><a href="mailto:arin-suggestions@arin.net">arin-suggestions@arin.net</a><br><a href="http://lists.arin.net/mailman/listinfo/arin-suggestions">http://lists.arin.net/mailman/<wbr>listinfo/arin-suggestions</a><br></div></div></blockquote></div><br></div></div><br>______________________________<wbr>_________________<br>
ARIN-Consult<br>
You are receiving this message because you are subscribed to the ARIN Consult Mailing<br>
List (<a href="mailto:ARIN-consult@arin.net">ARIN-consult@arin.net</a>).<br>
Unsubscribe or manage your mailing list subscription at:<br>
<a href="http://lists.arin.net/mailman/listinfo/arin-consult" rel="noreferrer">http://lists.arin.net/mailman/<wbr>listinfo/arin-consult</a> Please contact the ARIN Member Services<br>
Help Desk at <a href="mailto:info@arin.net">info@arin.net</a> if you experience any issues.<br></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature" data-smartmail="gmail_signature">===============================================<br>David Farmer <a href="mailto:Email%3Afarmer@umn.edu">Email:farmer@umn.edu</a><br>Networking & Telecommunication Services<br>Office of Information Technology<br>University of Minnesota <br>2218 University Ave SE Phone: 612-626-0815<br>Minneapolis, MN 55414-3029 Cell: 612-812-9952<br>===============================================</div>
</div></div></div>