Here’s the announcement from the Mozilla Security Blog: http://blog.mozilla.com/security/2009/07/27/locking-up-the-valuables-opt-in-security-with-forcetls/ http

Here’s the announcement from the Mozilla Security Blog: http://blog.mozilla.com/security/2009/07/27/locking-up-the-valuables-opt-in-security-with-forcetls/ http://blog.mozilla.com/security/2009/07/27/locking-up-the-v... I wonder how the initial request could be made secure. With the current proposal, if you happen to work over a compromised network connection the first time you open a site, the site cannot force your browser to connect over HTTPS and the attacker wins. Daniel Veditz commented on this concern: “...[W]elcome to the bootstrapping problem. We’re making the assumption that the sites people most want to protect from eavesdropping and tampering are those for which they’ve set up accounts. That means they connected correctly at least once, and this header could be set at that time. In addition, careful users could always add ‘https://’ https://’ themselves the first time and avoid that initial redirect.” (http://blog.mozilla.com/security/2009/07/27/locking-up-the-valuables-opt-in-security-with-forcetls/#comment-106091 http://blog.mozilla.com/security/2009/07/27/locking-up-the-v...)