4 ms·
Many sites can be included as HSTS only in Chrome itself, so it wouldn't be entirely useless. https://hstspreload.org https://hstspreload.org
by hrrsn 8y ago
Many sites can be included as HSTS only in Chrome itself, so it wouldn't be entirely useless.
https://hstspreload.org https://hstspreload.org
- Avamander 8y agoAnyone can preload their domain in Chrome, Firefox and others that share the preload list. I'm not sure what vulnerabilities are left after your site has been preloaded.
- deaps 8y agoThe only vulnerability left would be, as mentioned above, a client installing a browser that doesn't support HSTS.
- tedunangst 8y agoIf your attack relies on getting the user to install your own browser, don't waste your time with a simple HSTS bypass.