News for hackers. Stuff that matters.
Re:Bringing HSTS to www.google.com by chinathrow on Saturday July 30, 2016 @03:51AM (#12192070)
I was pretty sure that my Android Version uses google.com for the 204 generation. Without further updates, that would break.
Re:Bringing HSTS to www.google.com by icebraining on Saturday July 30, 2016 @04:21AM (#12192142)
Probably not; google.com will still reply on HTTP, it's just that if you have a browser that visits the HTTPS page, it'll record a rule to never visit the HTTP version. I doubt the code doing captive portal detection supports HSTS at all, so most likely it'll still work just fine.
Re:Bringing HSTS to www.google.com by chinathrow on Saturday July 30, 2016 @06:49AM (#12192457)
But that would be exactly the use case here; browse google manually and then hsts kicks in from then on. Later, I get a captive portal wifi and it uses http://www.google.com/generate_204 and whoops, no request sent and no way for the wifi to redirect me to their login portal.

Both happens in chrome hence the same browser context.

Re:Bringing HSTS to www.google.com by icebraining on Saturday July 30, 2016 @08:06AM (#12192630)
Ah, right; I was thinking about the detection mechanism (which probably doesn't use Chrome), not the redirection.
Re:Bringing HSTS to www.google.com by chinathrow on Saturday July 30, 2016 @12:38PM (#12193647)
Right, the detection mechanism is part of the OS, not the browser.

https://developer.android.com/reference/android/net/Connecti...