4 ms·
> It just takes the user clicking through some scary prompts If you turn on HSTS, you actually stop this completely. Chrome and Firefox will not allow you to c
by pimterry 10y ago
> It just takes the user clicking through some scary prompts
If you turn on HSTS, you actually stop this completely. Chrome and Firefox will not allow you to click through the prompt for an HSTS site - you're just blocked.
- sihil 10y agoOur HSTS header is set with an expiry of a year. Provided you've visited the Guardian in the last year then you will not be able to click through an invalid certificate, nor can an attacker intercept an HTTP connection as none will be made. At some stage we hope to list theguardian.com in the preloaded HSTS list that ships with the browsers, but unfortunately this is some time away as there are a handful of other subdomains on theguardian.com that are not yet HTTPS (you can only preload a domain along with all of its subdomains).