TLS Everywhere, not https: URIs (2015)

Re:TLS Everywhere, not https: URIs (2015) by AstralStorm on Monday August 08, 2016 @03:38AM (#12246051)

This is exactly why browsers warn about such redirects. That said, this reminds me of a similar discussion on mail servers. There, STARTTLS sees much more use.

The main problem is preventing downgrade attacks. With mail it is easy to just remember the setting for every server. Not so with websites.

[ Parent | on HN ]

Re:TLS Everywhere, not https: URIs (2015) by michaelt on Monday August 08, 2016 @05:34AM (#12246459)

I've seen quite a bit of criticism of it for mail servers [1] because an attacker can simply block the 'STARTTLS' message and (many) clients will silently accept that.

[1] https://www.agwa.name/blog/post/starttls_considered_harmful

[ Parent | on HN ]