4 ms·
Yeah. How many users (not power users) actually type https:// https:// into address bar? To my knowledge, if you don't include the protocol, browser default to
by innocenat 12y ago
Yeah. How many users (not power users) actually type https:// https:// into address bar? To my knowledge, if you don't include the protocol, browser default to HTTP.
- pizzeys 12y agoNot on Hacker News (and many other sites) with a modern browser. The first time you visit http://news.ycombinator.com http://news.ycombinator.com, it will redirect to https:// https://, and you're correct, if the first time you visit happens to be the time you are MITM'd, this is a weak point. However, after the first visit, your browser learns through HSTS (the Strict-Transport-Security header) that accessing news.ycombinator.com without TLS is not supported, and won't attempt to access it again except via TLS. (For a year, in HN's case - this is configurable by the site administrator.)
- vertex-four 12y agoPoint is that your grandparent comment was suggesting that visiting http://news.ycombinator.com http://news.ycombinator.com should not redirect to HTTPS.