3 ms·
> the https:// https:// link could be just a redirect back to an http:// http:// link, something the browser probably has no trouble doing. Doesn't HSTS preven
by dmurray 6y ago
> the https:// https:// link could be just a redirect back to an http:// http:// link, something the browser probably has no trouble doing.
Doesn't HSTS prevent exactly this? Sure, not every website implements it, but the most visited ones overwhelmingly do - it's certainly misleading to say "any website" in that context.
- VWWHFSfQ 6y agodoesn't the hsts header have to be delivered in cleartext the first time you visit the site with http? so your browser knows from then on it can only ever visit via https? the header can be removed in that initial cleartext request so it never gets set in your browser in the first place. I don't think HSTS works against highly targeted MITM attacks like this.
- strombofulous 6y agohsts lists ship with browsers. otherwise it'd be useless for the reason you described
- VWWHFSfQ 6y agobut that's not an exhaustive list of websites though. any website not in the list is vulnerable to this
- deleted 6y ago[deleted]
- netheril96 6y agobb88 raises a bad example. Not only is google protected by HSTS, but also most browsers ship with HSTS preload list that includes google. It is nearly impossible to perform downgrade attacks on google domains.
- heipei 6y agogoogle.com does not seem to return HSTS headers nor is it on the HSTS preload list in Chrome.