News for hackers. Stuff that matters.

A comment on Comcast Shot Themselves in the Foot with MTA-STS. Parent comment

Re:Comcast Shot Themselves in the Foot with MTA-STS by tptacek on Wednesday January 19, 2022 @06:16PM (#30001879)
You could start by explaining why you think HSTS is a dumpster fire. The idea behind HSTS is to ensure that sites intended only to be used over HTTPS are used only over HTTPS; it's not the kind of thing you're supposed to toggle or fiddle with.
[ Parent | on HN ]
Re:Comcast Shot Themselves in the Foot with MTA-STS by ocdtrekkie on Wednesday January 19, 2022 @06:25PM (#30001965)
I have written a neighbor comment. But in short: It removes user agency in the browser, and more than often solely exists to interfere with troubleshooting for the administrator trying to fix the issue.
[ Parent | on HN ]
Re:Comcast Shot Themselves in the Foot with MTA-STS by tptacek on Wednesday January 19, 2022 @06:35PM (#30002045)
It exists because without HSTS, attackers can defeat HTTPS trivially by spoofing HTTP responses to attempts to visit the (unintended) "http" site.
[ Parent | on HN ]