Understanding HTTP Strict Transport Security

http://www.troyhunt.com/2015/06/understanding-http-strict-transport.html

by paukiatwee • 11 years ago

41 10 11 years ago

troyhunt.com

Zikes• 11 years ago

How long before browsers default to HTTPS-first, so they don't have to carry around a hefty preload list?

Someone12342• 11 years ago

How long until websites stop hosting broken HTTPS sites with certificate errors? Same answer.

I use HTTPS Everywhere, you'd be surprised how many sites are broken by default in HTTPS.

nodesocket3• 11 years ago

Hackernews is one of them. I'm showing broken https in Chrome (43.0.2357.130).

"This site uses a weak security configuration (SHA-1 signatures), so your connection may not be private."

jtchang• 11 years ago

"Be aware that inclusion in the preload list cannot really be undone. You can request to be removed, but it will take months for the deleted entry to reach users with a Chrome update and we cannot make guarantees about other browser vendors."

So basically once you submit it your domain is forever HTTPS on Chrome? I'm sure there are cases that might warrant HTTP. Mostly though the cases I am coming up with are mostly testing or implementation speed. It is generally easier to stand up HTTP than HTTPS. At least for now until Lets Encrypt is standard.

gcp2• 11 years ago

So basically once you submit it your domain is forever HTTPS on Chrome?

Yes, and Firefox too since they share the preload lists.

Mostly though the cases I am coming up with are mostly testing or implementation speed. It is generally easier to stand up HTTP than HTTPS. At least for now until Lets Encrypt is standard.

That sounds more of an issue for new domains, rather than established ones, no? I mean once you set up an inverse proxy like nginx to handle the HTTPS side, that should disappear.

Understanding HTTP Strict Transport Security

Related Stories