3 ms·
Behavior like that needs to come with a huge warning label. It would be trivial for any man-in-the-middle to block https and server http.
by markild 10y ago
Behavior like that needs to come with a huge warning label.
It would be trivial for any man-in-the-middle to block https and server http.
- AstralStorm 10y agoThis is exactly why browsers warn about such redirects. That said, this reminds me of a similar discussion on mail servers. There, STARTTLS sees much more use. The main problem is preventing downgrade attacks. With mail it is easy to just remember the setting for every server. Not so with websites.
- michaelt 10y agoI've seen quite a bit of criticism of it for mail servers [1] because an attacker can simply block the 'STARTTLS' message and (many) clients will silently accept that. [1] https://www.agwa.name/blog/post/starttls_considered_harmful https://www.agwa.name/blog/post/starttls_considered_harmful
- hello_there 10y agoThey could display that same "this page is not secure"-page that they display on broken certificates.