3 ms·

"I think this can actually work even if Facebook does default to HTTPS, because users never actually reach Facebook itself." The certificate won't match. I don

"I think this can actually work even if Facebook does default to HTTPS, because users never actually reach Facebook itself." The certificate won't match. I don't know how many users will click past the big red warning page most browsers show, but I don't have much sympathy for them if they do.

thegeomaster 12y ago
I was referring to serving an ordinary HTTP page on port 80. Most people type facebook.com into the address bar and hit Enter (and don't have HTTPSEverywhere). In normal circumstances, Facebook would issue a redirect to https://facebook.com https://facebook.com, but if you're controlling the network you just serve the front page via HTTP.
- aptwebapps 12y ago
  Yes, I suppose that might work at least some of the time. Most browsers these days, however, would send you to the https site simply because you had visited it more frequently unless you typed out the full url and managed not to select the offered completion.
  - callahad 12y ago
    > Most browsers these days, however, would send you to the https site simply because you had visited it more frequently Actually, in that case, modern browsers would completely refuse to send you to the http site, even if you typed it in explicitly. All thanks to Facebook's 90 day HSTS header [0]. They could improve their security further by getting Facebook into the Chromium preload list. That list, which is shared with Firefox, eliminates the need for an initial, clear connection. [0]: https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security [1]: https://src.chromium.org/viewvc/chrome/trunk/src/net/http/transport_security_state_static.json https://src.chromium.org/viewvc/chrome/trunk/src/net/http/tr...
icambron 12y ago
You should have lots of sympathy for them, though. They're not on their guard about MITM attacks, so they deserve to have their data stolen?
- aptwebapps 12y ago
  I do have sympathy for them usually, just not when I wrote that. ;)

thegeomaster 12y ago

I was referring to serving an ordinary HTTP page on port 80. Most people type facebook.com into the address bar and hit Enter (and don't have HTTPSEverywhere). In normal circumstances, Facebook would issue a redirect to https://facebook.com https://facebook.com, but if you're controlling the network you just serve the front page via HTTP.

aptwebapps 12y ago
Yes, I suppose that might work at least some of the time. Most browsers these days, however, would send you to the https site simply because you had visited it more frequently unless you typed out the full url and managed not to select the offered completion.
- callahad 12y ago
  > Most browsers these days, however, would send you to the https site simply because you had visited it more frequently Actually, in that case, modern browsers would completely refuse to send you to the http site, even if you typed it in explicitly. All thanks to Facebook's 90 day HSTS header [0]. They could improve their security further by getting Facebook into the Chromium preload list. That list, which is shared with Firefox, eliminates the need for an initial, clear connection. [0]: https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security [1]: https://src.chromium.org/viewvc/chrome/trunk/src/net/http/transport_security_state_static.json https://src.chromium.org/viewvc/chrome/trunk/src/net/http/tr...

icambron 12y ago

You should have lots of sympathy for them, though. They're not on their guard about MITM attacks, so they deserve to have their data stolen?

aptwebapps 12y ago
I do have sympathy for them usually, just not when I wrote that. ;)