HSTS is a server config line, automated vulnerability scanners will pick it us. Sure that’s not optimal, but crypto is hard in general, HSTS is one of the easie

HSTS is a server config line, automated vulnerability scanners will pick it us. Sure that’s not optimal, but crypto is hard in general, HSTS is one of the easier to understand concepts. Fix the whole problem not one minor functional issue. The users machine cannot be part of a legitimate threat model. Either it’s compromised or it’s not. Either it’s FDE’d or it’s not. I wouldn’t even pretend that a HSTS assertion here or there would even make a difference in the shitshow that is browser cache. I agree it’s a hack, but at this point I pretty much think that about crypto standards, period. Having HSTS is better than not, and we’re a while away from disabling unencrypted comms.