Comcast Shot Themselves in the Foot with MTA-STS

Re:Comcast Shot Themselves in the Foot with MTA-STS by ocdtrekkie on Wednesday January 19, 2022 @06:25PM (#30001965)

I have written a neighbor comment. But in short: It removes user agency in the browser, and more than often solely exists to interfere with troubleshooting for the administrator trying to fix the issue.

[ Parent | on HN ]

Re:Comcast Shot Themselves in the Foot with MTA-STS by tptacek on Wednesday January 19, 2022 @06:35PM (#30002045)

It exists because without HSTS, attackers can defeat HTTPS trivially by spoofing HTTP responses to attempts to visit the (unintended) "http" site.

[ Parent | on HN ]