Not on Hacker News (and many other sites) with a modern browser. The first time you visit http://news.ycombinator.com http://news.ycombinator.com, it will redir

Not on Hacker News (and many other sites) with a modern browser. The first time you visit http://news.ycombinator.com http://news.ycombinator.com, it will redirect to https:// https://, and you're correct, if the first time you visit happens to be the time you are MITM'd, this is a weak point. However, after the first visit, your browser learns through HSTS (the Strict-Transport-Security header) that accessing news.ycombinator.com without TLS is not supported, and won't attempt to access it again except via TLS. (For a year, in HN's case - this is configurable by the site administrator.)