3 ms·
It's worth noting that HTTP->HTTPS redirect is, in some sense, game-over already. A malicious actor upstream can mitm by blocking the redirect and providing an
by air7 8y ago
It's worth noting that HTTP->HTTPS redirect is, in some sense, game-over already. A malicious actor upstream can mitm by blocking the redirect and providing an HTTP version to the client while communicating HTTPS to the server. sslstrip is one implementation.
- stereo 8y agoThat's why HSTS preloading is what you want to achieve. We've recently added openstreetmap.org and it was a fun project to make sure that everything would properly reply over https.
- repsilat 8y agoIf it gets the https version into your browser history it can prevent a MITM in the future, though. Not all bad.
- Scott_Helme_ 8y agoIndeed the HTTP -> HTTPS redirect is only the first step in solving the problem. A 301 redirect will offer some lasting protection as it can be cached but it's not really that great. The goal here is to take the first step to get on HTTPS and then longer term the sites can consider HSTS and eventually preloading.
- Scott_Helme_ 8y agoIt might also be useful to note I have a HSTS Cheat Sheet for more info: https://scotthelme.co.uk/hsts-cheat-sheet/ https://scotthelme.co.uk/hsts-cheat-sheet/
- dwheeler 8y agoA quick solution that solves many cases is to also use HTTP Strict Transport Security (HSTS), and declare it for at least a year. Then once the user visits the site (say from home) and gets the HSTS header, later visits in that time will always use HTTPS. This solves the problem in many cases. The best solution is to get your site into the HSTS preload list. You can do that here: https://hstspreload.org/ https://hstspreload.org/ - this adds the site to the Chrome list, and most other major browsers (Firefox, Opera, Safari, IE 11 and Edge) have an HSTS preload list based on the Chrome list. Once that happens and the browser updates, users will always use https, even if they ask for http.
- CydeWeys 8y agoEven simpler, just use a domain on an HSTS-preloaded TLD, like .app. And stay tuned for more options coming soon ;)
- jolmg 8y agoThis is also why it's preferable to use TLS-only ports for SMTP (465) and IMAP (993) instead of using the STARTTLS protocol extensions. Mail clients aren't required to enforce STARTTLS and might fallback to plain text when an MITM blocks the extension.