3 ms·

It will say "this website doesn't support https, do you want to connect anyway"

tialaramex 6y ago
Just checked this yup. If I go to https://neverssl.com/ https://neverssl.com/ I get a warning explaining that this site doesn't have a certificate for neverssl.com but only for Cloudfront (presumably where it's hosted) But if I try to go to http://neverssl.com/ http://neverssl.com/ then I get the message explaining that the HTTPS site doesn't work, do I want the insecure HTTP one instead?
- iso1631 6y ago
  If I specify http://whatever.com http://whatever.com in the address bar, or if I follow a link to http://whatever.com http://whatever.com, I'd expect it to attempt to connect to port 80 on whatever.com, and not redirect to https unless the page responds with a Location header If I type "whatever.com", I'm happy with it to try port 443 first I'm not sure if a http/80 page should be at least HEADed to see if there's a redirect to https/443 before throwing up the "this is not secure"
  - ldjb 6y ago
    I can understand your use case, but I know a lot of people (often those who use computers infrequently) type out the full URL all the time. They don't know what HTTP or HTTPS is, they don't realise you can omit that part. They just want to access the website. For those people, it makes sense that typing "http:// http://" would take them to the "https:// https://" site if available. Although they did specify HTTP, it isn't necessarily what they actually wanted. I think the use case you describe (whilst valid) only applies to a relatively small pool of people. Most people don't really understand HTTP or HTTPS very well. They know it's part of the web address, and some know that "https:// https://" is "secure", but that's about it. I think it makes sense to direct people to the secure version of the site as much as possible, whilst of course providing a mechanism to switch to the HTTP version if necessary.
    - iso1631 6y ago
      Most people type the address into google. If the server says that the thing on port 80 is better served from port 443, then it can issue a 302 permanently move (and a HSTS header to make it stick). If the server offers different content on port 80 and port 443 then the server can do so just fine. The browser should not try to second guess my explicit instructions.
  - ryan29 6y ago
    Many users don't know the difference between http and https, so if you're trying to get them redirected to a captive portal page it's a lot easier if the default is http.
- ryan29 6y ago
  That kind of sucks because if a user misses the initial OS redirect for a captive portal login, the easiest way to get them back to the authentication page is to have them hit an http site. However, things like HSTS make that really hard to do without having a site that does NOT use https and defaulting to https is like having HSTS triggered on every site. Having to tell them to click through a non-https warning is almost as bad as having to tell them to click through a TLS warning.
  - tialaramex 6y ago
    Captive Portals are the thing that sucks in this situation though. If you offer "free" WiFi behind an annoying Captive Portal chances are I'll just use my 3G service if it works. Now, in my mind do you think I consider you offered me "free" WiFi? No, it was too annoying to use. So your competitor that didn't bother with a Captive Portal site and just posted their WiFi password on a chalkboard - they have free WiFi and you don't.

Just checked this yup. If I go to https://neverssl.com/ https://neverssl.com/ I get a warning explaining that this site doesn't have a certificate for neverssl.com but only for Cloudfront (presumably where it's hosted) But if I try to go to http://neverssl.com/ http://neverssl.com/ then I get the message explaining that the HTTPS site doesn't work, do I want the insecure HTTP one instead?

iso1631 6y ago
If I specify http://whatever.com http://whatever.com in the address bar, or if I follow a link to http://whatever.com http://whatever.com, I'd expect it to attempt to connect to port 80 on whatever.com, and not redirect to https unless the page responds with a Location header If I type "whatever.com", I'm happy with it to try port 443 first I'm not sure if a http/80 page should be at least HEADed to see if there's a redirect to https/443 before throwing up the "this is not secure"
- ldjb 6y ago
  I can understand your use case, but I know a lot of people (often those who use computers infrequently) type out the full URL all the time. They don't know what HTTP or HTTPS is, they don't realise you can omit that part. They just want to access the website. For those people, it makes sense that typing "http:// http://" would take them to the "https:// https://" site if available. Although they did specify HTTP, it isn't necessarily what they actually wanted. I think the use case you describe (whilst valid) only applies to a relatively small pool of people. Most people don't really understand HTTP or HTTPS very well. They know it's part of the web address, and some know that "https:// https://" is "secure", but that's about it. I think it makes sense to direct people to the secure version of the site as much as possible, whilst of course providing a mechanism to switch to the HTTP version if necessary.
  - iso1631 6y ago
    Most people type the address into google. If the server says that the thing on port 80 is better served from port 443, then it can issue a 302 permanently move (and a HSTS header to make it stick). If the server offers different content on port 80 and port 443 then the server can do so just fine. The browser should not try to second guess my explicit instructions.
- ryan29 6y ago
  Many users don't know the difference between http and https, so if you're trying to get them redirected to a captive portal page it's a lot easier if the default is http.
ryan29 6y ago
That kind of sucks because if a user misses the initial OS redirect for a captive portal login, the easiest way to get them back to the authentication page is to have them hit an http site. However, things like HSTS make that really hard to do without having a site that does NOT use https and defaulting to https is like having HSTS triggered on every site. Having to tell them to click through a non-https warning is almost as bad as having to tell them to click through a TLS warning.
- tialaramex 6y ago
  Captive Portals are the thing that sucks in this situation though. If you offer "free" WiFi behind an annoying Captive Portal chances are I'll just use my 3G service if it works. Now, in my mind do you think I consider you offered me "free" WiFi? No, it was too annoying to use. So your competitor that didn't bother with a Captive Portal site and just posted their WiFi password on a chalkboard - they have free WiFi and you don't.