3 ms·

Thanks for explaining that. So sitting here trying to think about a way to solve that problem, what I come up with is essentially PKI. But if the attacker has

by just2n 14y ago

Thanks for explaining that. So sitting here trying to think about a way to solve that problem, what I come up with is essentially PKI. But if the attacker has the ability to inject code, they can always break this entirely by stealing my private key. This feels to me like URLs are fundamentally broken, in that a user might try to go to http://mybank.com http://mybank.com. Is there any secure way to get their browser to redirect to https://mybank.com https://mybank.com? It seems like there might be something that could be done with dnssec, but that feels brittle too. Gross.

stouset 14y ago
HTTP Strict Transport Security solves this.
- just2n 14y ago
  That only works if the user makes an https request first. Say the URL is: https://mybank.com https://mybank.com, but I go to http://mybank.com http://mybank.com, and I haven't been there yet, so the STS rule isn't in my browser. How can a user reliably be switched to https without risk of having the connection hijacked by someone injecting code to the user?