4 ms·

This is the whole reason the site itself doesn't direct you to https or advertise it is available. In order to support https, you don't just install a cert, you

This is the whole reason the site itself doesn't direct you to https or advertise it is available. In order to support https, you don't just install a cert, you know. You have to make sure your whole chain supports it. Including things like third party CDN providers, which can be more expensive to enable https than you pay for the CDN. So, if you use an extension that randomly directs you to connect using a method the site operator never told you to use, expect problems.

Someone1234 12y ago
> This is the whole reason the site itself doesn't direct you to https or advertise it is available. They are advertising it. They have a web-server running on 443 open to the public, they aren't required to, but they choose to. They're also erroneously returning status code 200 (instead of 404 or 301). > So, if you use an extension that randomly directs you to connect using a method the site operator never told you to use, expect problems. Nothing "random" about it. The site advertises that it has HTTP running on 80 and HTTPS on 443. So I have an extension which opts for 443 when status code 200 is returned as a first priority and then 80 as a backup. Google and Bing's search results do exactly the same thing. If they don't want people to use HTTPS/443 then simply shut it down, problem solved. If you have to have 443 running for another site then return status code 404 (or 301).
- X-Cubed 12y ago
  There is no reason that HTTP and HTTPS ports have to serve the same website. In this case, the HTTPS port is serving pebble.vanillaforums.com (or whatever) while the HTTP port is serving forums.getpebble.com. The HTTPS port could just as easily be serving up an admin page for the forums, rather than the forums themselves.
Too 12y ago
The site operator never told me to use plain http either. I just "randomly" ended up there by clicking on a link on HN that has no relation at all with the site. If you expect http->https redirection to be the only valid path to a https site, then a MITM attacker would obviously disable that redirection because it's still done on the unsecure channel. This is the whole reason extensions like https everywhere exists.

Someone1234 12y ago

> This is the whole reason the site itself doesn't direct you to https or advertise it is available. They are advertising it. They have a web-server running on 443 open to the public, they aren't required to, but they choose to. They're also erroneously returning status code 200 (instead of 404 or 301). > So, if you use an extension that randomly directs you to connect using a method the site operator never told you to use, expect problems. Nothing "random" about it. The site advertises that it has HTTP running on 80 and HTTPS on 443. So I have an extension which opts for 443 when status code 200 is returned as a first priority and then 80 as a backup. Google and Bing's search results do exactly the same thing. If they don't want people to use HTTPS/443 then simply shut it down, problem solved. If you have to have 443 running for another site then return status code 404 (or 301).

X-Cubed 12y ago
There is no reason that HTTP and HTTPS ports have to serve the same website. In this case, the HTTPS port is serving pebble.vanillaforums.com (or whatever) while the HTTP port is serving forums.getpebble.com. The HTTPS port could just as easily be serving up an admin page for the forums, rather than the forums themselves.

Too 12y ago

The site operator never told me to use plain http either. I just "randomly" ended up there by clicking on a link on HN that has no relation at all with the site. If you expect http->https redirection to be the only valid path to a https site, then a MITM attacker would obviously disable that redirection because it's still done on the unsecure channel. This is the whole reason extensions like https everywhere exists.