3 ms·

Is this also going to cause Chrome to attempt HTTPS before falling back to HTTP? That would be the more useful change. If HTTPS fails (due to hostname mismatch

Is this also going to cause Chrome to attempt HTTPS before falling back to HTTP? That would be the more useful change. If HTTPS fails (due to hostname mismatch for example), fall back to HTTP and warn, but trying HTTPS first would be fantastic and eliminate one round trip for many of my sites that are not in the HSTS preload...

Ajedi32 8y ago
Fail-open security is useless against any actual attack. The attacker would just block the TLS connection then intercept the resulting plain HTTP request. Google already defaults to linking HTTPS versions of pages in its search results, which is a much better solution IMO. (Attacker can't intercept the connection to Google because of HSTS, and can't intercept the connection to the site you visit because it's a direct HTTPS link.)
- X-Istence 8y ago
  > Fail-open security is useless against any actual attack. Except that if the user is not visiting for the first time, then HSTS comes into play if the security headers are set, browsers can let the user know something is amiss. We both agree that fail-open security is useless, but right now Chrome and other browsers default to going to port 80 for first visit instead of port 443. All I am asking is that the default becomes 443, and the fall-back, for first visit, is port 80. This way I can stop running web servers on port 80 that do nothing but send a 303 with https as the protocol for that particular domain.
cpeterso 8y ago
Chrome and Firefox use HTTPS first for sites in their preloaded HSTS lists. (I don't know if Edge has a preloaded HSTS list.) https://blog.mozilla.org/security/2012/11/01/preloading-hsts/ https://blog.mozilla.org/security/2012/11/01/preloading-hsts...
- X-Istence 8y ago
  > ut trying HTTPS first would be fantastic and eliminate one round trip for many of my sites that are not in the HSTS preload... It's almost as if you didn't read my post. Unless I can go register all my domains to be in the HSTS preload, I'd much rather Chrome tried HTTPS first, so I don't have to run a web server on port 80 that sends a 303 with https as the protocol.

Ajedi32 8y ago

Fail-open security is useless against any actual attack. The attacker would just block the TLS connection then intercept the resulting plain HTTP request. Google already defaults to linking HTTPS versions of pages in its search results, which is a much better solution IMO. (Attacker can't intercept the connection to Google because of HSTS, and can't intercept the connection to the site you visit because it's a direct HTTPS link.)

X-Istence 8y ago
> Fail-open security is useless against any actual attack. Except that if the user is not visiting for the first time, then HSTS comes into play if the security headers are set, browsers can let the user know something is amiss. We both agree that fail-open security is useless, but right now Chrome and other browsers default to going to port 80 for first visit instead of port 443. All I am asking is that the default becomes 443, and the fall-back, for first visit, is port 80. This way I can stop running web servers on port 80 that do nothing but send a 303 with https as the protocol for that particular domain.

cpeterso 8y ago

Chrome and Firefox use HTTPS first for sites in their preloaded HSTS lists. (I don't know if Edge has a preloaded HSTS list.) https://blog.mozilla.org/security/2012/11/01/preloading-hsts/ https://blog.mozilla.org/security/2012/11/01/preloading-hsts...

X-Istence 8y ago
> ut trying HTTPS first would be fantastic and eliminate one round trip for many of my sites that are not in the HSTS preload... It's almost as if you didn't read my post. Unless I can go register all my domains to be in the HSTS preload, I'd much rather Chrome tried HTTPS first, so I don't have to run a web server on port 80 that sends a 303 with https as the protocol.