5 ms·
That was a good extension for a specific time. I stopped using it about 5 years ago when everyone had been pushing HTTPS hard, and Let's Encrypt had become popu
by theandrewbailey 4y ago
That was a good extension for a specific time. I stopped using it about 5 years ago when everyone had been pushing HTTPS hard, and Let's Encrypt had become popular. I didn't notice any websites not using HTTPS, so I didn't look back.
- bombcar 4y agohttp://neverssl.com http://neverssl.com remains for those badly-setup wifi networks.
- silviot 4y agoThanks! I'll stop using captive.apple.com now that I know about this!
- robjan 4y agoYou can also use example.com. I find that easier to remember.
- tialaramex 4y agoThe example names are just examples, it so happens that today they have a web site and it isn't HSTS. Tomorrow maybe they have HSTS. The week after maybe they get rid of the web site. The names are merely examples, and so it's probably a bad idea to use them for any other purpose.
- doliveira 4y agoCool, they even generate subdomains dynamically to avoid caching
- lambda_matt 4y agoBeat me to it. beats the hell out portscanning the subnet at the airport
- RealStickman_ 4y agoOr alternatively http://httpforever.com/ http://httpforever.com/
- rav 4y agoSimilar to HTTPS-only being built into web browsers, isn't captive portal detection built into all modern OSes? What's the badly-setup wifi network that requires you to open your browser but doesn't get detected properly by the OS as a captive portal?
- notatoad 4y agoit isn't so much "badly" set up as maliciously set up. Captive portal vendors like to find ways of defeating the operating system's captive portal detection, because it hinders their ability to show ads after the captive portal login process.
- deleted 4y ago[deleted]
- deleted 4y ago[deleted]
- eslaught 4y agoIt's funny that if I navigate to this site with HTTPS-only mode, it redirects to an HTTPS page.
- _tki0 4y agohttps://twitter.com/NeverSSL/status/1456310362551164928 https://twitter.com/NeverSSL/status/1456310362551164928
- viraptor 4y agoThere are still places that don't auto-redirect to https for some reason. Maybe a temporary misconfiguration. I just ran into http://www.mbsonline.gov.au http://www.mbsonline.gov.au today and was surprised it didn't redirect and has broken https, even though that org really shouldn't do that.
- necovek 4y agoA redirect itself is considered bad by some because it encourages relying on http in the first place (imagine always hitting a web site through http and expecting a redirect instead of going to https directly). As soon as you do that, you are similarly prone to MITM attacks: on an insecure network, you hit an http site and it replaces the redirect with one to a https site that looks like the same domain but really isn't (with a valid cert for mbsonline.gov.au.foo.io). For my personal sites, I prefer to go with no redirects and if it really processes data, https-only. For users, the right solution isfor browsers to always attempt https first even if those could be technically serving entirely different content (that would be one hell of an anti-pattern though, so I wouldn't worry about it).
- marcosdumay 4y agoA permanent redirection before setting the correct headers is the best you can do at the server side. Yes, the user is using insecure practices, and no, you can't correct it on your server.
- necovek 4y agoI am arguing that the best you can do is not even have HTTP enabled. A permanent redirect is the second best ;) And yeah, most practical for commercial entities (which is why I highlighted what I do for my personal sites).
- C4K3 4y agoThe best you can do is set HSTS and redirect from http to https. You not serving http won't prevent a MITM from serving http to the victim.
- Dunedan 4y agoOne website not supporting HTTPS which caught my eye is http://paulgraham.com/ http://paulgraham.com/
- kevincox 4y agoI've been using HTTPS-only mode on Firefox for many months now. The place where I see HTTP links most often is email tracking links. I'm commonly automatically upgraded to HTTPS and it works but very often there is no HTTPS support at all. Even for sensitive things like password resets that have secret tokens in the URL.
- tialaramex 4y agoA few sites I run into once in a while have the following bad setup, which HTTPS-only flags (because it's actually unsafe) but looks normal to most people: 1. http://www.example.com/ http://www.example.com/ exists and redirects to http://example.com/ http://example.com/ 2. http://example.com/ http://example.com/ also exists and redirects to https://example.com/ https://example.com/ 3a https://example.com/ https://example.com/ works fine but 3b https://www.example.com/ https://www.example.com/ does not exist 4. External links go to http://www.example.com/stuff/goes/here http://www.example.com/stuff/goes/here You will also see the mirror image mistake (www.example.com is canonical, but the redirects go from example.com only on HTTP) at similar rates. This is all because Tim chose not to rely on SRV records to make his toy hypermedia system work and decades later we're still paying for this (among others) mistake.
- Lanley 4y agoI'm surprised by the number of German websites (.de) I've encountered this year that don't support HTTPS. I think they're all small businesses or personal sites, but still unexpected.