3 ms·
So what does it mean if now UA vendors have 1 million hosts added to HSTS pre-load list? Are they all created equal? Do they share the same preload list? Is the
by yeukhon 11y ago
So what does it mean if now UA vendors have 1 million hosts added to HSTS pre-load list? Are they all created equal? Do they share the same preload list? Is there a single form to submit to all UA vendors? What if you have internal hosts that you still want the same mitigation in place? What is UA vendors' SLA on updating preload list? Preload suffers the same problem as pinning, correct me if I am wrong.
- ejcx 11y agoPreload does not suffer the same issue as pinning using a header. All sites on the list would just look like you probably visited them, which means ambiguity. Not all UAs share the same preload list, but they all borrow from the chrome preload list. Read here https://hstspreload.appspot.com/ https://hstspreload.appspot.com/. Its not a great ecosystem and I dont forsee it as one that is improving, with encryption being a big issue in some countries