Re:HTTPS Everywhere will sunset in January 2023
by necovek on Wednesday May 25, 2022 @08:50PM
(#31512890)
My point is that you want to "educate" visitors to never use HTTP (eg. for their bookmarks and typing the URL in), which I hope is effectively achieved by not having HTTP web site even on a connection you trust (eg. your local network) — so if you succeeded in "educating" them at least for your web site, they are similarly protected when they come back, including from another device. If they only rely on their browsers caching the permanent redirect, they are protected for a short time on the same browser.
But ultimately, browsers have to default to HTTPS for a guaranteed "protection" from the start (whether that's through HSTS preload lists or simply by defaulting to HTTPS, does not matter much).
For the first time - you're affected either way.
For the second time - if you still have the permanent redirect cached, you avoid the mitm.
Disabling your own http only helps the attacker in specific situations.