All HTTPS all the time is the only real solution. Both those band aids rely on distributing rules to browsers describing when to use HTTPS with what sites. That

All HTTPS all the time is the only real solution. Both those band aids rely on distributing rules to browsers describing when to use HTTPS with what sites. That is totally unscalable, not to mention only as secure as the ruleset distribution channel.