2 ms·
Browsers should consider not showing a green lock unless a site uses HSTS.
by nostromo 11y ago
Browsers should consider not showing a green lock unless a site uses HSTS.
- MichaelGG 11y agoBut even with HSTS, if it wasn't preloaded, an attacker could inject cookies on the first visit (then take user to real HTTPS site). Or, if the domain doesn't have full HSTS for all subdomains, there's still a potential vuln as you can inject from non-HSTS subdomains. The paper notes that Google and some other big properties have technical issues in deploying global HSTS.
- ploxiln 11y agoMajor browsers have given up on user indicators anyway. They've decided that all they can do is pass/fail, and if fail, make it very hard for the user to access the site at all. (I hate the trend but that's how it is.)