3 ms·
But there are protections against this, such as HSTS. I would expect someone with as much sensitive information as Equifax to have HSTS + HPKP pinned into the m
by RainaRelanah 9y ago
But there are protections against this, such as HSTS. I would expect someone with as much sensitive information as Equifax to have HSTS + HPKP pinned into the major browsers. Their server should never even receive an HTTP request. It's just unrivaled incompetence.
- discreditable 9y agoHSTS doesn't help if it's your first visit to the site. To work around that they'd need to get into a preload list.
- andygambles 9y agoWhich is easy if you set preload header.
- tonyztan 9y agoThis. The technology (HSTS, HPKP, Subresource Integrity, upgrade-insecure-requests) is there; sites that need it just don't seem to use it.