5 ms·

>different cookies That protection essentially already exists with the secure bit in cookies and the __Secure- prefix. The problem is that http:// http:// lin

>different cookies That protection essentially already exists with the secure bit in cookies and the __Secure- prefix. The problem is that http:// http:// links exist all over the web, and a website owner cannot force all incoming links to say https:// https:// instead. Without HSTS, any time a user clicks one of those links, the user's ISP will be able to see the exact URL the user is visiting, and might even inject ads or other stuff[1] into the page. HSTS solves that. Disclosure: Google employee, and my license plate is HSTS [1] https://en.wikipedia.org/wiki/Great_Cannon https://en.wikipedia.org/wiki/Great_Cannon

zzo38computer 4y ago
While it is true, I should think that it should be better to be up to the end user to decide what they want, and that it should not assume that everyone else knows better instead. If the user writes "http" then it is http, if the user writes "https" then it is https, etc. (What it should do if the suer does not specify the scheme is a different question, and different users may have different preferences (which should probably be configurable). My preference is that it would treat the URL as relative instead of absolute in that case, but that is probably minority.)
- Thorrez 4y ago
  Most users have no idea what any of this means. Even I often don't know what one is best. I want to use https:// https:// if it's available, and http:// http:// otherwise. Should every time I want to click a link, I instead right click to copy the link location, then paste it into the URL bar and modify it to https:// https:// to try that, and then if it fails to load, change it back to http:// http:// ? That's a massive amount of work. I want it to just work without all that hassle and having to keep a info in my mind of which websites support https:// https:// and which don't. >If the user writes "http" then it is http, if the user writes "https" then it is https Should we also block the website from doing a redirect to https:// https:// ? HSTS is basically just a redirect cache.
  - zzo38computer 4y ago
    > Most users have no idea what any of this means. OK, but users who do know what it means should be allowed to configure it differently. The computer software should be designed for advanced users, who do know what it means (and includes documentation in case you do not know). > I want to use https:// https:// if it's available, and http:// http:// otherwise. Should every time I want to click a link, I instead right click to copy the link location, then paste it into the URL bar and modify it to https:// https:// to try that, and then if it fails to load, change it back to http:// http:// ? No; it should be configurable to do it automatically how you want to do. > I want it to just work without all that hassle and having to keep a info in my mind of which websites support https:// https:// and which don't. There are also other ways to do that even without HSTS, though. Still, it should be configurable by the end user. > Should we also block the website from doing a redirect to https:// https:// ? No, that it isn't up to the client side to block. (I think that most web sites should not automatically redirect in this way, but that is not related to the client software.) > HSTS is basically just a redirect cache. Then it is deficient since it is not the only kind of redirect. Furthermore, it is bad because it does so without the user's specifying if they want this cache or if the user wishes to override it for any reason, making some things difficult to do. It should not try to think they know better than the end user what the end user is wanting to do.
    - Thorrez 4y ago
      >OK, but users who do know what it means should be allowed to configure it differently. Yeah, I agree. In order to avoid bloat, it might be best to offload this to extensions. >No; it should be configurable to do it automatically how you want to do. I agree, but I think complex configuration should be offloaded to extensions. By default it should do what the website owner wants (HSTS). >Then it is deficient since it is not the only kind of redirect. Other kinds of redirects aren't relevant for security, so they don't need as the degree of cache guarantees that HSTS provides. >Furthermore, it is bad because it does so without the user's specifying if they want this cache Stuff should be secure by default. We don't want security to be opt in. >or if the user wishes to override it for any reason, making some things difficult to do. I agree there should be overrides. >It should not try to think they know better than the end user what the end user is wanting to do. Sometimes the end user actually doesn't know what the end user is trying to do and gets phished. I agree there should be overrides though, but they need to be carefully designed so that attackers can't abuse them.

zzo38computer 4y ago

While it is true, I should think that it should be better to be up to the end user to decide what they want, and that it should not assume that everyone else knows better instead. If the user writes "http" then it is http, if the user writes "https" then it is https, etc. (What it should do if the suer does not specify the scheme is a different question, and different users may have different preferences (which should probably be configurable). My preference is that it would treat the URL as relative instead of absolute in that case, but that is probably minority.)

Thorrez 4y ago
Most users have no idea what any of this means. Even I often don't know what one is best. I want to use https:// https:// if it's available, and http:// http:// otherwise. Should every time I want to click a link, I instead right click to copy the link location, then paste it into the URL bar and modify it to https:// https:// to try that, and then if it fails to load, change it back to http:// http:// ? That's a massive amount of work. I want it to just work without all that hassle and having to keep a info in my mind of which websites support https:// https:// and which don't. >If the user writes "http" then it is http, if the user writes "https" then it is https Should we also block the website from doing a redirect to https:// https:// ? HSTS is basically just a redirect cache.
- zzo38computer 4y ago
  > Most users have no idea what any of this means. OK, but users who do know what it means should be allowed to configure it differently. The computer software should be designed for advanced users, who do know what it means (and includes documentation in case you do not know). > I want to use https:// https:// if it's available, and http:// http:// otherwise. Should every time I want to click a link, I instead right click to copy the link location, then paste it into the URL bar and modify it to https:// https:// to try that, and then if it fails to load, change it back to http:// http:// ? No; it should be configurable to do it automatically how you want to do. > I want it to just work without all that hassle and having to keep a info in my mind of which websites support https:// https:// and which don't. There are also other ways to do that even without HSTS, though. Still, it should be configurable by the end user. > Should we also block the website from doing a redirect to https:// https:// ? No, that it isn't up to the client side to block. (I think that most web sites should not automatically redirect in this way, but that is not related to the client software.) > HSTS is basically just a redirect cache. Then it is deficient since it is not the only kind of redirect. Furthermore, it is bad because it does so without the user's specifying if they want this cache or if the user wishes to override it for any reason, making some things difficult to do. It should not try to think they know better than the end user what the end user is wanting to do.
  - Thorrez 4y ago
    >OK, but users who do know what it means should be allowed to configure it differently. Yeah, I agree. In order to avoid bloat, it might be best to offload this to extensions. >No; it should be configurable to do it automatically how you want to do. I agree, but I think complex configuration should be offloaded to extensions. By default it should do what the website owner wants (HSTS). >Then it is deficient since it is not the only kind of redirect. Other kinds of redirects aren't relevant for security, so they don't need as the degree of cache guarantees that HSTS provides. >Furthermore, it is bad because it does so without the user's specifying if they want this cache Stuff should be secure by default. We don't want security to be opt in. >or if the user wishes to override it for any reason, making some things difficult to do. I agree there should be overrides. >It should not try to think they know better than the end user what the end user is wanting to do. Sometimes the end user actually doesn't know what the end user is trying to do and gets phished. I agree there should be overrides though, but they need to be carefully designed so that attackers can't abuse them.