3 ms·

> The threat model they're addressing is the one where users have a small semblance of control over their devices and networks. I've been saying for years that

> The threat model they're addressing is the one where users have a small semblance of control over their devices and networks. I've been saying for years that HTTPS everywhere, DoH, eSNI (or it's successor), etc. are part of a long term plan for big tech to have absolute control over what users are allowed and not allowed to do with their own devices. I had thought so too, and also "secure contexts" (apparently there is supposed to be a way to configure this, but it does not seem to be the case) and HSTS, too. I think that HSTS is very bad. (HTTPS is not bad, but all of these things that are forcing them is a bad idea.)

judge2020 4y ago
IMO the downside of HSTS you’re referring to only applies to the specific HSTS-only TLDs. Otherwise, HSTS is useful to prevent a downgrade attack where someone types in http://bank.com http://bank.com on a new computer and poisoned DNS (via a rogue network operator or hacked router) means the initial page load for the bank loads over HTTP and thus the IP returned can show a fake login page, even to the point of the browser auto-filling login credentials.
- zzo38computer 4y ago
  > initial page load for the bank loads over HTTP and thus the IP returned can show a fake login page, even to the point of the browser auto-filling login credentials. That problem would correctly be solved in a different way. "http://example.com/ http://example.com/" is different from "https://example.com/ https://example.com/" and so would have different cookies, auto-fill, etc. An indicator can be used in the location bar or status bar if needing to indicate the protocol and security clearly. The browser also should not auto-fill anything without the user's permission, regardless of protocol and TLS.
  - Thorrez 4y ago
    >different cookies That protection essentially already exists with the secure bit in cookies and the __Secure- prefix. The problem is that http:// http:// links exist all over the web, and a website owner cannot force all incoming links to say https:// https:// instead. Without HSTS, any time a user clicks one of those links, the user's ISP will be able to see the exact URL the user is visiting, and might even inject ads or other stuff[1] into the page. HSTS solves that. Disclosure: Google employee, and my license plate is HSTS [1] https://en.wikipedia.org/wiki/Great_Cannon https://en.wikipedia.org/wiki/Great_Cannon
    - zzo38computer 4y ago
      While it is true, I should think that it should be better to be up to the end user to decide what they want, and that it should not assume that everyone else knows better instead. If the user writes "http" then it is http, if the user writes "https" then it is https, etc. (What it should do if the suer does not specify the scheme is a different question, and different users may have different preferences (which should probably be configurable). My preference is that it would treat the URL as relative instead of absolute in that case, but that is probably minority.)
      - Thorrez 4y ago
        Most users have no idea what any of this means. Even I often don't know what one is best. I want to use https:// https:// if it's available, and http:// http:// otherwise. Should every time I want to click a link, I instead right click to copy the link location, then paste it into the URL bar and modify it to https:// https:// to try that, and then if it fails to load, change it back to http:// http:// ? That's a massive amount of work. I want it to just work without all that hassle and having to keep a info in my mind of which websites support https:// https:// and which don't. >If the user writes "http" then it is http, if the user writes "https" then it is https Should we also block the website from doing a redirect to https:// https:// ? HSTS is basically just a redirect cache.
        zzo38computer 4y ago
        > Most users have no idea what any of this means. OK, but users who do know what it means should be allowed to configure it differently. The computer software should be designed for advanced users, who do know what it means (and includes documentation in case you do not know). > I want to use https:// https:// if it's available, and http:// http:// otherwise. Should every time I want to click a link, I instead right click to copy the link location, then paste it into the URL bar and modify it to https:// https:// to try that, and then if it fails to load, change it back to http:// http:// ? No; it should be configurable to do it automatically how you want to do. > I want it to just work without all that hassle and having to keep a info in my mind of which websites support https:// https:// and which don't. There are also other ways to do that even without HSTS, though. Still, it should be configurable by the end user. > Should we also block the website from doing a redirect to https:// https:// ? No, that it isn't up to the client side to block. (I think that most web sites should not automatically redirect in this way, but that is not related to the client software.) > HSTS is basically just a redirect cache. Then it is deficient since it is not the only kind of redirect. Furthermore, it is bad because it does so without the user's specifying if they want this cache or if the user wishes to override it for any reason, making some things difficult to do. It should not try to think they know better than the end user what the end user is wanting to do.

judge2020 4y ago

IMO the downside of HSTS you’re referring to only applies to the specific HSTS-only TLDs. Otherwise, HSTS is useful to prevent a downgrade attack where someone types in http://bank.com http://bank.com on a new computer and poisoned DNS (via a rogue network operator or hacked router) means the initial page load for the bank loads over HTTP and thus the IP returned can show a fake login page, even to the point of the browser auto-filling login credentials.

zzo38computer 4y ago
> initial page load for the bank loads over HTTP and thus the IP returned can show a fake login page, even to the point of the browser auto-filling login credentials. That problem would correctly be solved in a different way. "http://example.com/ http://example.com/" is different from "https://example.com/ https://example.com/" and so would have different cookies, auto-fill, etc. An indicator can be used in the location bar or status bar if needing to indicate the protocol and security clearly. The browser also should not auto-fill anything without the user's permission, regardless of protocol and TLS.
- Thorrez 4y ago
  >different cookies That protection essentially already exists with the secure bit in cookies and the __Secure- prefix. The problem is that http:// http:// links exist all over the web, and a website owner cannot force all incoming links to say https:// https:// instead. Without HSTS, any time a user clicks one of those links, the user's ISP will be able to see the exact URL the user is visiting, and might even inject ads or other stuff[1] into the page. HSTS solves that. Disclosure: Google employee, and my license plate is HSTS [1] https://en.wikipedia.org/wiki/Great_Cannon https://en.wikipedia.org/wiki/Great_Cannon
  - zzo38computer 4y ago
    While it is true, I should think that it should be better to be up to the end user to decide what they want, and that it should not assume that everyone else knows better instead. If the user writes "http" then it is http, if the user writes "https" then it is https, etc. (What it should do if the suer does not specify the scheme is a different question, and different users may have different preferences (which should probably be configurable). My preference is that it would treat the URL as relative instead of absolute in that case, but that is probably minority.)
    - Thorrez 4y ago
      Most users have no idea what any of this means. Even I often don't know what one is best. I want to use https:// https:// if it's available, and http:// http:// otherwise. Should every time I want to click a link, I instead right click to copy the link location, then paste it into the URL bar and modify it to https:// https:// to try that, and then if it fails to load, change it back to http:// http:// ? That's a massive amount of work. I want it to just work without all that hassle and having to keep a info in my mind of which websites support https:// https:// and which don't. >If the user writes "http" then it is http, if the user writes "https" then it is https Should we also block the website from doing a redirect to https:// https:// ? HSTS is basically just a redirect cache.
      - zzo38computer 4y ago
        > Most users have no idea what any of this means. OK, but users who do know what it means should be allowed to configure it differently. The computer software should be designed for advanced users, who do know what it means (and includes documentation in case you do not know). > I want to use https:// https:// if it's available, and http:// http:// otherwise. Should every time I want to click a link, I instead right click to copy the link location, then paste it into the URL bar and modify it to https:// https:// to try that, and then if it fails to load, change it back to http:// http:// ? No; it should be configurable to do it automatically how you want to do. > I want it to just work without all that hassle and having to keep a info in my mind of which websites support https:// https:// and which don't. There are also other ways to do that even without HSTS, though. Still, it should be configurable by the end user. > Should we also block the website from doing a redirect to https:// https:// ? No, that it isn't up to the client side to block. (I think that most web sites should not automatically redirect in this way, but that is not related to the client software.) > HSTS is basically just a redirect cache. Then it is deficient since it is not the only kind of redirect. Furthermore, it is bad because it does so without the user's specifying if they want this cache or if the user wishes to override it for any reason, making some things difficult to do. It should not try to think they know better than the end user what the end user is wanting to do.