News for hackers. Stuff that matters.

A comment on Timing attack against HSTS to sniff browser history in Chrome and Firefox. Parent comment

Re:Timing attack against HSTS to sniff browser history in Ch... by toomuchtodo on Monday October 26, 2015 @11:01PM (#10456018)
Can anyone who runs a high trafficked site and isn't on the HSTS preload list explain why not? I am genuinely interested.
[ Parent | on HN ]
Re:Timing attack against HSTS to sniff browser history in Ch... by ejcx on Monday October 26, 2015 @11:16PM (#10456087)
There's a lot of pressure to turn the includeSubdomains flag on, with the new Google Submission Process (submit a form to hstspreload.appspot.com).

Not all businesses are in a situation where they can just turn on HTTPS across all subdomains. I'm sure agl will make exceptions if you reach out and are a high traffic site.

[ Parent | on HN ]