4 ms·

I've never quite understood the preload list. Is its only job to save the initial 301 redirect from http > https on first load? Also, wouldn't bundling (tens

I've never quite understood the preload list. Is its only job to save the initial 301 redirect from http > https on first load? Also, wouldn't bundling (tens of) thousands of domains start to add up, and slow down first page load for regular browser use? I'm sure I must be missing something, because this doesn't seem very logical to me.

daenney 9y ago
In a way yes, it's trying to avoid the initial redirect. But not in order to save you from the potential latency of the initial redirect: > These sites do not depend on the issuing of the HSTS response header to enforce the policy, instead the browser is aleady aware that the host requires the use of SSL/TLS before any connection or communication even takes place. This removes the opportunity an attacker has to intercept and tamper with redirects that take place over HTTP. Read this: https://scotthelme.co.uk/hsts-preloading/ https://scotthelme.co.uk/hsts-preloading/ > Also, wouldn't bundling (tens of) thousands of domains start to add up, and slow down first page load for regular browser use? Why would it? Checking in a data structure if the domain the user requested should be loaded over HTTPS can be done in a perfectly efficient way. A hash table would give you O(1) lookup times on average and there's other things you can use to mitigate the worst case lookup of O(n).
- SquareWheel 9y ago
  Good answer, thanks. I was hoping the article would cover the scaling aspect a bit more. I guess it's just meant to be a mid-step towards browsers defaulting to HTTPS at some unknown point in the future.
  - pfg 9y ago
    The maintainer of the HSTS preload list wrote a detailed report on the current state of HSTS preloading last year, covering the list size aspect[1]. [1]: https://docs.google.com/document/d/1LqpwT2aAekrWPtLui5GYdHSGlZNMNRYmPR14NXMRsQ4/edit# https://docs.google.com/document/d/1LqpwT2aAekrWPtLui5GYdHSG...
cesarb 9y ago
> Is its only job to save the initial 301 redirect from http > https on first load? If there's an attacker between you and the website, you will never see the 301 redirect. The preload list was designed for that kind of scenario.

daenney 9y ago

In a way yes, it's trying to avoid the initial redirect. But not in order to save you from the potential latency of the initial redirect: > These sites do not depend on the issuing of the HSTS response header to enforce the policy, instead the browser is aleady aware that the host requires the use of SSL/TLS before any connection or communication even takes place. This removes the opportunity an attacker has to intercept and tamper with redirects that take place over HTTP. Read this: https://scotthelme.co.uk/hsts-preloading/ https://scotthelme.co.uk/hsts-preloading/ > Also, wouldn't bundling (tens of) thousands of domains start to add up, and slow down first page load for regular browser use? Why would it? Checking in a data structure if the domain the user requested should be loaded over HTTPS can be done in a perfectly efficient way. A hash table would give you O(1) lookup times on average and there's other things you can use to mitigate the worst case lookup of O(n).

SquareWheel 9y ago
Good answer, thanks. I was hoping the article would cover the scaling aspect a bit more. I guess it's just meant to be a mid-step towards browsers defaulting to HTTPS at some unknown point in the future.
- pfg 9y ago
  The maintainer of the HSTS preload list wrote a detailed report on the current state of HSTS preloading last year, covering the list size aspect[1]. [1]: https://docs.google.com/document/d/1LqpwT2aAekrWPtLui5GYdHSGlZNMNRYmPR14NXMRsQ4/edit# https://docs.google.com/document/d/1LqpwT2aAekrWPtLui5GYdHSG...

cesarb 9y ago

> Is its only job to save the initial 301 redirect from http > https on first load? If there's an attacker between you and the website, you will never see the 301 redirect. The preload list was designed for that kind of scenario.