I find that many sites implement HSTS and the redirect to HTTPS wrong. For example, they will have http://example.com redirect to https://www.example.com instead of first redirecting to https://example.com. According to the spec, the browser will not automatically upgrade to HTTPS next time, leaving that first request still open to attack.
[Kind of a plug: I made a test for this in my tool, DomainProactive (https://domainproactive.com). I would appreciate feedback on this kind of error.]
Re:Ask HN: Is Public WiFi Dangerous?
by boring_twenties on Friday March 18, 2022 @02:25PM
(#30725733)
Indeed. I now have firefox configured to always try HTTPS first. A warning pops up if it doesn't work, and you have to click through it if you want to proceed. It turns out that a large number of sites not only have http://example.com redirect to https://www.example.com, as you describe, but https://example.com doesn't work at all -- resulting in this warning. Clicking through it, you end up at https://www.example.com.
Exactly. A commonly missed attack vector is just intercepting plaintext http and blocking https, so the browser thinks the site doesn't offer https and will just continue in plaintext. The same criticism applies to smtp using starttls, an attacker can suppress the starttls command and the default is to just continue in plaintext.
This is why an https only mode is important. In Firefox it can be enabled somewhere in the settings.
Luckily browsers are nowadays shifting towards making the initial request via HTTPS. Chrome, for example, has been using HTTPS when typing an address into the address bar without specifying http:// explicitly [1].
[1]: https://blog.chromium.org/2021/03/a-safer-default-for-naviga...
no, it will relay your URL via Google Search :P
Unless you enable HTTPS-only mode, or HTTPS Everywhere EASE mode.
What usually happens these days is a redirect to the HTTPS site, but that first request can still be attacked.