News for hackers. Stuff that matters.

A comment on TLS Everywhere, not https: URIs (2015). Parent comment

Re:TLS Everywhere, not https: URIs (2015) by markild on Monday August 08, 2016 @02:09AM (#12245758)
Behavior like that needs to come with a huge warning label.

It would be trivial for any man-in-the-middle to block https and server http.

[ Parent | on HN ]
Re:TLS Everywhere, not https: URIs (2015) by AstralStorm on Monday August 08, 2016 @03:38AM (#12246051)
This is exactly why browsers warn about such redirects. That said, this reminds me of a similar discussion on mail servers. There, STARTTLS sees much more use.

The main problem is preventing downgrade attacks. With mail it is easy to just remember the setting for every server. Not so with websites.

[ Parent | on HN ]
Re:TLS Everywhere, not https: URIs (2015) by michaelt on Monday August 08, 2016 @05:34AM (#12246459)
I've seen quite a bit of criticism of it for mail servers [1] because an attacker can simply block the 'STARTTLS' message and (many) clients will silently accept that.

[1] https://www.agwa.name/blog/post/starttls_considered_harmful

[ Parent | on HN ]
Re:TLS Everywhere, not https: URIs (2015) by hello_there on Monday August 08, 2016 @04:32AM (#12246249)
They could display that same "this page is not secure"-page that they display on broken certificates.
[ Parent | on HN ]