> That's just a default. And your point is? If there is no port specified, that's what it's on if the protocol is HTTPS? > You can use TLS with a broken ciphe

> That's just a default. And your point is? If there is no port specified, that's what it's on if the protocol is HTTPS? > You can use TLS with a broken cipher. You can use SSL_NULL_WITH_NULL_NULL. Browsers will helpfully provide things like a slash through the https in cases like this. As they should, because allowing such things to happen automatically is contrary to what the spec is expecting to happen: > If the hostname does not match the identity in the certificate, user > oriented clients MUST either notify the user (clients MAY give the > user the opportunity to continue with the connection in any case) or > terminate the connection with a bad certificate error. elsewhere > In order to prevent this form of attack, users should carefully > examine the certificate presented by the server to determine if it > meets their expectations. - RFC 2818 "HTTP over TLS" (http://tools.ietf.org/html/rfc2818 http://tools.ietf.org/html/rfc2818) (for the second quote, the User Agent automates that process to make sure the certificate meets trust and expiration and the cipher suite meets exceptions.)