That's why I said alleviate, not solve. HSTS is a bandaid at best. The bottom line is regular people don't know the difference between entering "www.mybank.com

That's why I said alleviate, not solve. HSTS is a bandaid at best. The bottom line is regular people don't know the difference between entering "www.mybank.com" or "https://www.mybank.com" https://www.mybank.com", they never do the latter, and they rarely notice if a page is non-HTTPS if it has other icons that make it seem secure (e.g. "McAfee protected")--hence the reason sslstrip exists in the first place.