Security.txt Standard Proposed, Similar To Robots.txt (bleepingcomputer.com) 86
An anonymous reader writes: Ed Foudil, a web developer and security researcher, has submitted a draft to the IETF — Internet Engineering Task Force — seeking the standardization of security.txt, a file that webmasters can host on their domain root and describe the site's security policies. The file is akin to robots.txt, a standard used by websites to communicate and define policies for web and search engine crawlers...
For example, if a security researcher finds a security vulnerability on a website, he can access the site's security.txt file for information on how to contact the company and securely report the issue. According to the current security.txt IETF draft, website owners would be able to create security.txt files that look like this:
#This is a comment
Contact: security@example.com
Contact: +1-201-555-0123
Contact: https://example.com/security
Encryption: https://example.com/pgp-key.tx...
Acknowledgement: https://example.com/acknowledg...
Disclosure: Full
For example, if a security researcher finds a security vulnerability on a website, he can access the site's security.txt file for information on how to contact the company and securely report the issue. According to the current security.txt IETF draft, website owners would be able to create security.txt files that look like this:
#This is a comment
Contact: security@example.com
Contact: +1-201-555-0123
Contact: https://example.com/security
Encryption: https://example.com/pgp-key.tx...
Acknowledgement: https://example.com/acknowledg...
Disclosure: Full
HTML? (Score:4, Informative)
There's going to be <a href>> tags in security.txt? No? Then don't make the links clickable in the fucking summary.
Re: (Score:2, Informative)
The Aspergers is strong in this one.
+1 (Score:2)
Hell, I'll be implementing that Monday morning for a couple servers, screw waiting for the standard.
Re: +1 (Score:1)
Minus 1 for stupidity (Score:2, Insightful)
if a security researcher finds a security vulnerability on a website, he can access the site's security.txt file for information on how to contact the company and securely report the issue.
This is based on the false assumption that websites actually care about security. 99.9% of all companies couldn't care less, as proven by the almost daily occurrence of breaches.
Re: (Score:2)
It is based on the false assumption that the ones looking up the security.txt file would be people with your best interest in mind, and not spammers and telemarketers who want to sell you security products, or black hats looking for contacts to spearfish.
Spam! (Score:5, Insightful)
Yay! Zillions of more juicy Email addresses and phone numbers to collect and spam! Robots will sweep up all that data and hammer the "contacts" to death.
Re: (Score:2)
Couldn't agree more ! This was exactly what I was thinking : the security contact address will be spammed so hard that it'll be hard to find the mails that should get through.
Re:Spam! (Score:5, Funny)
No, the security.txt file will be excluded from crawling via the robots.txt file
Re:Spam! (Score:4, Funny)
Yay! Zillions of more juicy Email addresses and phone numbers to collect and spam! Robots will sweep up all that data and hammer the "contacts" to death.
Just exclude the "security.txt" file in the "robots.txt" file - problem solved. :-)
Re:Spam! (Score:5, Funny)
For US sites, how about adding the Admin's SSN, their address and their Mother's Maiden names ? That way we can really know the file is genuine
Re: (Score:1)
Sounds like http://www.equifax.com/security.txt
So, just like DNS records then? (Score:2)
So, just like DNS records [icann.org] then?
Re: Please explain the need? (Score:1)
Rewolve? (Score:4, Funny)
...who should be competent enough to get the information to a qualified person to rewolve the issue.
Thanks for mentioning that. I totally missed the lycantrhopy part.
Re: Rewolve? (Score:1)
Re: (Score:1)
Really?
I've not found line breaks a problem here.
Ever.
Re: Rewolve? (Score:1)
) Whenever I view my comments, there is not anline break to be found.
Re: Rewolve? (Score:1)
Line break.
Re: (Score:2)
Not
Using
Line breaks
Only
Hitting
Return.
Works just fine here on iOS 10 with Safari.
Re: (Score:2)
It's a /. account setting that has nothing to do with where the input comes from.
Re: (Score:2)
... And apparently I can't spell lycanthropy correctly the first time.
Here's my guess... (Score:3)
Re: (Score:1)
Yep. Will happen. Besides, unnecessary. Whois entry already has contact info (if it's correct and maintained). If necessary, perhaps a line could be added to the Whois info? And maintenance is the issue: better to have it in one place.
Re: (Score:2)
even worse than that, the goddamn telemarketers will be all over the phone number.
Sure thing (Score:1)
How long until root kits are updated to change the contact info to look like lolz@yeahnope.com and the phone number of some random Equifax branch office? -PCP
P3P redux (Score:4, Insightful)
It's almost like https://www.w3.org/P3P/ wasn't already a thing that died with a whimper 10 years ago. On the other hand, an almost syntax-free text-file might gain some more traction, even if I fail to see how that's actually useful over some "About" or "Contact" link on the website menu.
Re: (Score:2)
It's extremely useful. If you see this file with contact details, you know that you have a legal defense if they try to sue you for pointing out their crap security.
Re: (Score:2)
It's extremely useful. If you see this file with contact details, you know that you have a legal defense if they try to sue you for pointing out their crap security.
That's an argument for why you want them to do it, not why they should want to do it.
Re: (Score:2)
If they care about security it helps them. If they don't, it's absence warns people to do anonymous disclosure.
Re: (Score:2)
The issue I pointed out wasn't that this wouldn't be useful, but that P3P is a W3C officially recommended protocol/standard started 20 years ago that already does this but much better. However, it never really caught on, and I suspect one main reason is companies don't really want accountability. For the legal defense, the only solution would be a law unequivocally granting immunity if you disclose a vulnerability in responsible manner. A security.txt file isn't worth the paper it's printed on (ie. none) in
Example (Score:3, Funny)
Re: Example (Score:4, Informative)
Example.com is owned by IANA [iana.org].
This type of example is precisely what example.com is set up for, and is defined in RFC 2606.
Non problem (Score:5, Insightful)
This is not a solution to any real problem.
The problem is companies that don't want to hear about vulnerabilities. Those companies are unlikely to put up security.txt entries.
"None so deaf as those that will not hear. None so blind as those that will not see." Matthew Henry.
Re: (Score:2)
On the contrary, standards are super important. If not having a security.txt was considered as negligence by the courts, you'd find many companies needing to add them in order for certifications or to not face crazy damages in the case of a breach. An objective, easy standard like security.txt makes that significantly more likely than anything that requires technical expertise.
Further, it will lead to standardized/codified standards to respond and cascade in that manner.
Re: (Score:2)
My entire point is that ignoring standards ups the "Y" in your story. Literally, that's it. There's not much in that situation that really is likely to change... except X and Y. If something makes those two cross (cheaper security/costlier fines), then that changes the story.
And, they most certainly can cross. They have in the past for some conditions, and they will again for others in the future.
Re: (Score:2)
On the contrary, standards are super important.
Where I live often seems as if standardizing the size and shape of check boxes is what's most important.
If not having a security.txt was considered as negligence by the courts
More likely companies would be afraid to add security.txt for fear its presence represents implicit permission/cover to hack/probe.
Researchers already face legal risks simply for reporting what they innocently stumble upon. Personally I would only report site vulnerabilities anonymously and probably not even that.
You'd find many companies needing to add them in order for certifications or to not face crazy damages in the case of a breach.
My own opinion this is much more likely to end up being yet another joke nobody quite gets
Re: (Score:2)
Bang on!
Security, proper, I mean proper proper, as in 'I say it to my Master, he does not beat me with a stick for being stupid' proper...
Proper security does not, and cannot, assume that they other lot are abiding by any sort of social convention. Anything less is 'faux security' and, while very marketable, is worse than nothing.
The only laws hackers must abide by are those of physics and mathematics, and only then when physics and mathematics are done properly.
20 Years Too Late. Whois Already Exists. (Score:3, Insightful)
20 years ago this would have been a fantastic idea. In 2017, this is just another potential security hole. Spammers will scrape and hit those contacts hard.
Also, as another pointed out, may offer little protection, since hackers can, presumably, can alter the security.txt file too. It's not even signed, so how would one know which is the correct one? Presumably, Google, Microsoft, Apple, etc could maintain a security.txt registry and monitor changes. Then flag such changes in web browsers that can do such lookups. That could help, but increases the complexity. Whois, while far from perfect, already provides much same functionality.
Making contact easier is a worthy goal, but security.txt seems the wrong way to go about it.
Re: (Score:2)
Better idea (Score:5, Interesting)
Here's a better idea:
Put the security.txt above the server's Document Root. That way you'd actually have to hack/exploit the server to get at the security contact's information.
What about the WHOIS database (Score:1)
Re: (Score:1)
Isn't it obvious? It doesn't involve http so it might as well not exist, as far as "full stack developers" are concerned. Reinventing the wheel badly is what computing is all about.
Yes, whois was invented exactly for this sort of thing. Indeed, this proposal is in no way an improvement over the existing infrastructure.
Also, a pox on the editors for linking bleepingcomputer and not the IETF. But this seems to be the gold standard in "web" also.
Honestly, everyone who does understand what whois is for ought to
whois? (Score:2)
Dude ... (Score:1)
How to get spammed in one easy step (Score:2)
Step 1. Add a file security.txt to your web server containing your contact information.
Draft itself has an obvious security hole.
Section 4:
" As stated in Section 2.4, keys specified using the "Encryption:" directive SHOULD be loaded over HTTPS."
There is no suggestion anywhere in the draft security.txt be served over a secure transport rendering section 4 suggestion for reference to public key be secure moot.
Re: (Score:2)
That's not going to help anything (Score:2)
The problem is that they don't want to hear about it. You want to see some change? Promote whichever existing security advisory system is most ruthless about disclosure, and send everyone there to announce everything they discover.
RFC 5785 (Score:1)