Re:Bringing HSTS to www.google.com
by chinathrow on Saturday July 30, 2016 @03:51AM
(#12192070)
I was pretty sure that my Android Version uses google.com for the 204 generation. Without further updates, that would break.
[ Parent
| on HN ]
Re:Bringing HSTS to www.google.com
by icebraining on Saturday July 30, 2016 @04:21AM
(#12192142)
Probably not; google.com will still reply on HTTP, it's just that if you have a browser that visits the HTTPS page, it'll record a rule to never visit the HTTP version. I doubt the code doing captive portal detection supports HSTS at all, so most likely it'll still work just fine.
Re:Bringing HSTS to www.google.com
by chinathrow on Saturday July 30, 2016 @06:49AM
(#12192457)
But that would be exactly the use case here; browse google manually and then hsts kicks in from then on. Later, I get a captive portal wifi and it uses http://www.google.com/generate_204 and whoops, no request sent and no way for the wifi to redirect me to their login portal.
Both happens in chrome hence the same browser context.
Re:Bringing HSTS to www.google.com
by icebraining on Saturday July 30, 2016 @08:06AM
(#12192630)
Ah, right; I was thinking about the detection mechanism (which probably doesn't use Chrome), not the redirection.
Re:Bringing HSTS to www.google.com
by chinathrow on Saturday July 30, 2016 @12:38PM
(#12193647)
Right, the detection mechanism is part of the OS, not the browser.
https://developer.android.com/reference/android/net/Connecti...