8 ms·

No. HSTS prevents SSLStrip attacks when the intended destination is always meant to be in SSL.

• peterwwillis 13y ago
  SSLStrip does not work on valid HTTPS requests. If you request an HTTPS page, it can not be subverted into HTTP. If it could, HTTPS would be pointless. So, yes, HSTS is not required for a valid HTTPS request. This is not some semantic argument, or some sort of side channel attack crap. HSTS is not necessary for HTTPS requests, period.
  • thirsteh 13y ago
    It's necessary for HTTP requests. Are you being deliberately obtuse?
    • ars_technician 13y ago
      It doesn't work if the user hasn't visited the site before because the HSTS header can be stripped just as easily.
      • gtklocker 13y ago
        https://news.ycombinator.com/item?id=6978539 https://news.ycombinator.com/item?id=6978539
      • lvh 13y ago
        The HSTS specification tells you not to put those headers in regular HTTP requests anyway. Also, you're forgetting about browsers that ship with lists of HSTS-enabled sites.
  • gtklocker 13y ago
    https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security#Applicability https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security...