4 ms·
List of secure websites
- tshtf 11y agoNote that adding your site to the HSTS whitelist in Chrome (from which Firefox, Safari, and Edge will follow) is very easy: https://hstspreload.appspot.com/ https://hstspreload.appspot.com/
- keehun 11y agoThank you for that. I was quite clueless on how this list was put together.
- tptacek 11y agoBetter title: "The Chromium Built-In HSTS Whitelist". Search for "noisebridge", which is right around where all the small sites start.
- i336_ 11y agoIMO the HSTS list should have a description field.
- fivesigma 11y agoSo all applications to the HSTS preloaded list are hardcoded in that json. How big will that file get in a few years? Looks like the first addition of user submitted websites was done over a year ago. I wonder how ubiquitous HTTP/2 (TLS mandatory) will affect this.
- ktt 11y agoTLS is not strictly mandatory in HTTP/2 (see h2c) but even if it was this list solves another problem - when user types e.g. Google.com in their browser the initial connection is made via HTTP. Preload list says "if this domain is typed in address bar go straight to HTTPS, if that's not possible stop the connection".
- jakobdabo 11y agoI couldn't find a single mainstream media website in this list. Only the Washington Post and RT are accessible through HTTPS, but no HSTS headers are provided. edit: removed acronym
- buro9 11y agoI don't know what MSM is. But if they are a group doing media and content websites, HSTS and full SSL are still hard to accomplish due to the advertising industry dragging it's collective feet and knuckles.
- nodesocket 11y agoIt it me, or does a hard-coded json file that is manually maintained and compiled-in seem like a terrible idea? Couldn't Chrome just phone home to a secure server to retrieve HSTS data every once and awhile (just like updates).
- ktt 11y agoThen the attacker could just block the update servers.