4 ms·
Actually, if you go to reddit.com/login directly, you get http://reddit.com/login http://reddit.com/login, not https://reddit.com/login https://reddit.com/login
by thirsteh 13y ago
Actually, if you go to reddit.com/login directly, you get http://reddit.com/login http://reddit.com/login, not https://reddit.com/login https://reddit.com/login, which means anyone can forge the login page. This is the problem HSTS was designed to be a bandaid for, but reddit doesn't use it:
# curl -i reddit.com/login
HTTP/1.1 302 Moved Temporarily
Server: AkamaiGHost
Content-Length: 0
Location: http://www.reddit.com/login
Date: Sun, 30 Jun 2013 22:50:13 GMT
Connection: keep-alive
# curl -i www.reddit.com/login
HTTP/1.1 302 Moved Temporarily
Content-Length: 0
Location: https://ssl.reddit.com/login
Cache-Control: no-cache
Date: Sun, 30 Jun 2013 22:50:24 GMT
Connection: keep-alive