3 ms·

Thanks, but then what do I do about HTTP-only sites? Why can't it default to HTTPS and then auto-fallback to HTTP when HTTPS connections fail for sites that are

Thanks, but then what do I do about HTTP-only sites? Why can't it default to HTTPS and then auto-fallback to HTTP when HTTPS connections fail for sites that aren't in the known-HTTPS list? It seems like a logical thing to do instead of just going straight to HTTP.

tialaramex 6y ago
This only helps you at all against passive adversaries. An active adversary will just cheerfully block that HTTPS connection because you'll fall back to insecure silently.
- mehrdadn 6y ago
  I fully understand that and that's still clearly still better than going straight to HTTP, which it's already doing.