4 ms·
doesn't the hsts header have to be delivered in cleartext the first time you visit the site with http? so your browser knows from then on it can only ever visi
by VWWHFSfQ 6y ago
doesn't the hsts header have to be delivered in cleartext the first time you visit the site with http? so your browser knows from then on it can only ever visit via https? the header can be removed in that initial cleartext request so it never gets set in your browser in the first place. I don't think HSTS works against highly targeted MITM attacks like this.
- strombofulous 6y agohsts lists ship with browsers. otherwise it'd be useless for the reason you described
- VWWHFSfQ 6y agobut that's not an exhaustive list of websites though. any website not in the list is vulnerable to this
- deleted 6y ago[deleted]
- netheril96 6y agobb88 raises a bad example. Not only is google protected by HSTS, but also most browsers ship with HSTS preload list that includes google. It is nearly impossible to perform downgrade attacks on google domains.