3 ms·
"Additional, HSTS (with preloading) is quite widely deployed (especially at big cloud services), which makes plain text downgrade attacks hard to deploy." looo
by cypherg 4y ago
"Additional, HSTS (with preloading) is quite widely deployed (especially at big cloud services), which makes plain text downgrade attacks hard to deploy."
looooooooooooool
Turns out, that was a lie
- eloy 4y agoIs it? I just checked https://hstspreload.org/ https://hstspreload.org/, and it seems that twitter.com, facebook.com, outlook.com, cloudflare.com and gmail.com are all preloaded. Or do you mean that downgrade attacks are still easy to deploy? Under what circumstances?
- JackGreyhat 4y agoWith a reverse proxy. You can reverse proxy any HSTS website, and feed it to any client over plain http
- notriddle 4y agoA client with the HSTS preload list will not connect to facebook.com over plan HTTP. That's the whole point.