4 ms·Making Twitter more secure: HTTPS14 points by abraham 16y agolamby 16y agoWait, the check for whether a user always wants to use HTTPS is done after they login over HTTP?abraham 16y agoLogin is POSTed to a SSL endpoint at which point cookies are set that are SSL only. Passwords are never sent over a non-SSL request.lamby 16y agoThanks. Although without HTTP STS or similar I could still MITM the landing page.. :)abraham 16y agoVery true! I hadn't even thought of that.