4 ms·
HSTS somewhat solves the case after the first connection, but I dream of a world we’re HTTP is disabled for public ip access
by Bnshsysjab 7y ago
HSTS somewhat solves the case after the first connection, but I dream of a world we’re HTTP is disabled for public ip access
- TekMol 7y agoHSTS has more downsides then upsides. First of all its additional complexity that has to be implemented by the website. More work, more things that can go wrong. Second, it needs to store data on users machine. It is basically a cookie. So users would need to kiss goodbye privacy to "benefit" from it. Third, it only works if the user has connected to the site on the same browser before. And did not delete the cached HSTS data. So in sum, it kills privacy, works only sometimes and piles up on the stack. It's a typical bandaid solultion. Instead of fixing the root cause, it makes things worse.
- GlitchMr 7y agoHSTS Preload exists.
- Bnshsysjab 7y agoHSTS is a server config line, automated vulnerability scanners will pick it us. Sure that’s not optimal, but crypto is hard in general, HSTS is one of the easier to understand concepts. Fix the whole problem not one minor functional issue. The users machine cannot be part of a legitimate threat model. Either it’s compromised or it’s not. Either it’s FDE’d or it’s not. I wouldn’t even pretend that a HSTS assertion here or there would even make a difference in the shitshow that is browser cache. I agree it’s a hack, but at this point I pretty much think that about crypto standards, period. Having HSTS is better than not, and we’re a while away from disabling unencrypted comms.