News for hackers. Stuff that matters.

A comment on “Users will only be able to view patents via HTTP. HTTPS will no longer work”.

Re:“Users will only be able to view patents via HTTP. HTTPS ... by snvzz on Saturday April 22, 2017 @01:29PM (#14173593)
Fun fact: HSTS

https://securityheaders.io/?q=www.uspto.gov&followRedirects=...

HSTS is 1 year at the time this comment is posted. They're in for some pain.

[ Parent | on HN ]
Re:“Users will only be able to view patents via HTTP. HTTPS ... by Edmond on Saturday April 22, 2017 @02:13PM (#14173823)
That should be considered a non-fun fact :)

They are basically going to be DOSing a huge segment of users who've previously had that header set on their browsers...they're also violating the OMB mandate that requires TLS for all government sites...it is a rather strange move, I can't imagine there is a good reason for it.

EDIT If it is for portal.uspto.gov then HSTS is a non-issue but still a very bad move.

[ Parent | on HN ]
Re:“Users will only be able to view patents via HTTP. HTTPS ... by javawizard on Saturday April 22, 2017 @08:55PM (#14175804)
> EDIT If it is for portal.uspto.gov then HSTS is a non-issue but still a very bad move.

Is it? I still see HSTS from portal.uspto.gov with the same age.

[ Parent | on HN ]
Re:“Users will only be able to view patents via HTTP. HTTPS ... by andygambles on Saturday April 22, 2017 @01:40PM (#14173634)
Removal of HTTPS is on http://portal.uspto.gov/
[ Parent | on HN ]
Re:“Users will only be able to view patents via HTTP. HTTPS ... by shif on Saturday April 22, 2017 @02:46PM (#14174031)
chrome://net-internals/#hsts

doesn't seem to show anything for the domain

[ Parent | on HN ]