3 ms·
"Also, if they type in http:// http://, they simply don't get anything" If I were writing an SSL strip style tool, I'd make sure it listened on port 80 and 443
by mike-cardwell 12y ago
"Also, if they type in http:// http://, they simply don't get anything"
If I were writing an SSL strip style tool, I'd make sure it listened on port 80 and 443, and then even if the end-site didn't support http, I'd still pick up the http connection and forward it on to the real site via HTTPS.
I don't see the value in not providing a HTTP redirect. A MITM can still pick up a HTTP connection, even if you're not listening for it yourself...
- bitexploder 12y agoBecause, the user's browser will remember that it should be HTTPS. With HSTS the user's browser will refuse to go to the HTTP at all. Thats how HSTS works, the browser remembers that the site has the HSTS setting. HSTS also prevents the overriding of the bad certificate message. It is like anti-ssl strip. HSTS is harder to get around than this :)
- mike-cardwell 12y agoI know how HSTS works. I was responding to the claim that offering a HTTP service which redirects to HTTPS somehow reduces security, even when HSTS is in use.