News for hackers. Stuff that matters.
Re:Ask HN: Is Public WiFi Dangerous? by mcculley on Friday March 18, 2022 @02:14PM (#30725623)
I find that many sites implement HSTS and the redirect to HTTPS wrong. For example, they will have http://example.com redirect to https://www.example.com instead of first redirecting to https://example.com. According to the spec, the browser will not automatically upgrade to HTTPS next time, leaving that first request still open to attack.

[Kind of a plug: I made a test for this in my tool, DomainProactive (https://domainproactive.com). I would appreciate feedback on this kind of error.]

Re:Ask HN: Is Public WiFi Dangerous? by boring_twenties on Friday March 18, 2022 @02:25PM (#30725733)
Indeed. I now have firefox configured to always try HTTPS first. A warning pops up if it doesn't work, and you have to click through it if you want to proceed. It turns out that a large number of sites not only have http://example.com redirect to https://www.example.com, as you describe, but https://example.com doesn't work at all -- resulting in this warning. Clicking through it, you end up at https://www.example.com.