3 ms·

See https://hstspreload.org https://hstspreload.org

• pmoriarty 9y ago
  Ok, so that works for Chrome, but every other application is still going to be subject to an MITM attack if their users try to connect via http?
  • lukegb 9y ago
    As long as the other application is Firefox, Safari, IE11/Edge, or Opera, then it probably has a HSTS preload list that is at least in part generated from the Chrome one. Firefox have some scripts which go through and check to make sure everything still on the Chrome list is still announcing the preload headers, and will autoremove if that isn't that case, IIRC. I wouldn't be too shocked if Apple/Microsoft were doing something similar.
    • pmoriarty 9y ago
      "As long as the other application is Firefox, Safari, IE11/Edge, or Opera, then it probably has a HSTS preload list that is at least in part generated from the Chrome one." Is there any documentation for these browsers that officially say exactly what they're doing and how their preload lists are generated?
      • kilotaras 9y ago
        Here's a firefox one https://wiki.mozilla.org/SecurityEngineering/HTTP_Strict_Transport_Security_(HSTS)_Preload_List https://wiki.mozilla.org/SecurityEngineering/HTTP_Strict_Tra...