3 ms·
> I think this can actually work even if Facebook does default to HTTPS, because users never actually reach Facebook itself. If the user has successfully reach
by callahad 12y ago
> I think this can actually work even if Facebook does default to HTTPS, because users never actually reach Facebook itself.
If the user has successfully reached Facebook in the past 90 days, then their browser will have seen FB's HSTS header, and refuse to connect without TLS... provided they're not browsing with IE. :(