News for hackers. Stuff that matters.

A comment on HTTP Strict Transport Security (HSTS). Parent comment

Re:HTTP Strict Transport Security (HSTS) by dspillett on Tuesday December 30, 2025 @05:32PM (#46438870)
For new sites that is definitely practical. Modern versions of Chrom{e|ium} & Firefox (and other browsers based on them) have defaulted to HTTPS when the protocol is not specified. The only potential issue is if users do specify the protocol and leave the S out, it would be good for browsers to try HTTPS when HTTP fails (though only if it completely fails to connect).
[ Parent | on HN ]
Re:HTTP Strict Transport Security (HSTS) by baobun on Wednesday December 31, 2025 @06:35AM (#46443313)
> Modern versions of Chrom{e|ium} & Firefox (and other browsers based on them) have defaulted to HTTPS when the protocol is not specified.

This is not true but it would be nice if it was.

https://news.ycombinator.com/item?id=46443199

[ Parent | on HN ]
Re:HTTP Strict Transport Security (HSTS) by dspillett on Wednesday December 31, 2025 @07:10AM (#46443478)
Hmm. I am perhaps confusing announced plans, and the effect of the HSTS preload lists, with actually released changes to defaults.

I'll have to install some fresh VMs and see what behaviour I get out-of-the-box with no HSTS cache (and sites not on the preload lists) on various OSs, to correct my understanding.

[ Parent | on HN ]