3 ms·
Application layer security doesn't just mean VPNs. What websites are you connecting to with sensitive information that don't use HTTPS with HSTS preload nowaday
by bspammer 7y ago
Application layer security doesn't just mean VPNs. What websites are you connecting to with sensitive information that don't use HTTPS with HSTS preload nowadays?
- geofft 7y agoHere's one from just yesterday: the password reset form for sched.com, which the Linux Foundation uses for schedules, is HTTP. I had to follow this link to upload my slides for a talk I'm giving at a LF conference next week. Yes, the ideal, which we should all be actively working towards, is HTTPS. That doesn't mean that the world is already there.
- dankohn1 7y agoNote that Let's Encrypt, which is making universal https possible, is also part of the Linux Foundation. I was going to complain to sched.com for you, but I can't replicate the problem: https://ossna19.sched.com/password-reset https://ossna19.sched.com/password-reset is the default and http://ossna19.sched.com/password-reset http://ossna19.sched.com/password-reset redirects to it. (I work for the Linux Foundation.)
- geofft 7y agoThe email you get in your inbox when you do that is http. It starts with http://a.sched.com/track/click/ http://a.sched.com/track/click/.
- dankohn1 7y agoI worked with Sched.com this week based on your feedback and that link is now https. Thanks.
- quickthrower2 7y agoAwesome work