3 ms·
I asked this earlier today on its own thread: Why don't browsers default to trying HTTPS if there is a DNS record but no response on port 80? Or better yet, de
by 3pt14159 10y ago
I asked this earlier today on its own thread:
Why don't browsers default to trying HTTPS if there is a DNS record but no response on port 80? Or better yet, default to just trying HTTPS first. I understand I can add my site to browser based HSTS lists, but this doesn't really help people developing command line applications or API client libraries where a 302 could be followed without the developer even noticing and if I want to develop a MITM proof application I currently have a usability problem.
Is there a reason to support HTTP at all, other than current user experience in the browser?
- pfg 10y agoThat was discussed here, starting with [1]. tl;dr: Too many broken sites out there, and this kind of opportunistic encryption doesn't hold up in any adversarial threat model (MitM blocks :443 and forces downgrade to :80). [1]: https://news.ycombinator.com/item?id=12872100 https://news.ycombinator.com/item?id=12872100