4 ms·
>(If you're in charge of maintaining a web server, please consider allowing unencrypted traffic on port 80 (rather than unconditionally redirecting to HTTPS), u
by ThePowerOfFuet 3y ago
>(If you're in charge of maintaining a web server, please consider allowing unencrypted traffic on port 80 (rather than unconditionally redirecting to HTTPS), unless the Upgrade-Insecure-Requests[1] is present. Coupled with HSTS[2], it allows these "living museum pieces" to stay alive, while not compromising on security.)
So we kneecap the security of the general public in favour of the convenience of a few hobbyists? No. Nothing is stopping you from using a newer browser such as one of the many forks of Firefox, some of which exist solely to fill that need.
- rollcat 3y agoRead my other reply in this thread: https://news.ycombinator.com/item?id=38262103 https://news.ycombinator.com/item?id=38262103 I agree with your stance on every single count but one. If your request already hits the plaintext 80->443 redirect, you've already lost; there's nothing the server can do to guarantee security, and refusing service altogether does not complicate the task for an intercepting proxy, because they can still make an upstream HTTPS request and serve it back over plaintext. That game was always lost, which was the original motivation behind HTTPS, and then HSTS. This scenario is not hypothetical; it's literally what you must do if your hardware is not capable enough (my G4 struggles along, but older CPUs are the true test of patience). I wrote TLS-stripping, HTML-rewriting proxies for fun, and every HTTP client that trusts the web server with redirecting to HTTPS is vulnerable. If this affects you, the problem is that your web browser is likely more ancient than mine - HSTS with preloads has been a thing for like a decade.