3 ms·

Fail-open security is useless against any actual attack. The attacker would just block the TLS connection then intercept the resulting plain HTTP request. Goog

Fail-open security is useless against any actual attack. The attacker would just block the TLS connection then intercept the resulting plain HTTP request. Google already defaults to linking HTTPS versions of pages in its search results, which is a much better solution IMO. (Attacker can't intercept the connection to Google because of HSTS, and can't intercept the connection to the site you visit because it's a direct HTTPS link.)

X-Istence 8y ago
> Fail-open security is useless against any actual attack. Except that if the user is not visiting for the first time, then HSTS comes into play if the security headers are set, browsers can let the user know something is amiss. We both agree that fail-open security is useless, but right now Chrome and other browsers default to going to port 80 for first visit instead of port 443. All I am asking is that the default becomes 443, and the fall-back, for first visit, is port 80. This way I can stop running web servers on port 80 that do nothing but send a 303 with https as the protocol for that particular domain.