3 ms·
> The user reached the site through an HTTPS URL Were I in charge, that's the detail I'd change. An "https" URL is actually requesting a certain quality of sec
by prodigal_erik 14y ago
> The user reached the site through an HTTPS URL
Were I in charge, that's the detail I'd change. An "https" URL is actually requesting a certain quality of security service and should fail without trustworthy authentication, but using insecure TLS opportunistically (e.g., caching the result from a prior "Upgrade" header or OPTIONS request) for a "http" URL would be fine since cleartext would also have been fine.
- tptacek 14y agoI think this makes sense too, in the context of the security model we have now, but I'd rather see a better trust model that allows everything to be encrypted all the time safely. I think we'll have it eventually.