2 ms·
Sorry for not having been clear. Put it another way: are there hard stats about HSTS actual value? How many orgs that had their DNS defaced and new certs issued
by BrandoElFollito 3y ago
Sorry for not having been clear. Put it another way: are there hard stats about HSTS actual value? How many orgs that had their DNS defaced and new certs issued were saved by HSTS?
Since a mistake with HSTS is catastrophic, setting it must make sense risk wise.
- Dylan16807 3y agoAre you confusing HSTS with HPKP like the other poster? HSTS says the site has to be https, nothing else. It does nothing if someone gets a valid cert. It exists to prevent every attack weaker than that, such as local MitM. And mistakes are not catastrophic at all unless you have some horrible legacy setup that can't do https.
- BrandoElFollito 3y agooh crap, I was thinking HPKP and reading/writing HSTS. Sorry for the entropy. Yes, HSTS (this time HSTS :)) is useful (though there are problems with scaling for the initial seed of pages, but maybe that was already solved).