HTTP Strict Transport Security (HSTS)

Re:HTTP Strict Transport Security (HSTS) by dxdm on Wednesday December 31, 2025 @03:50AM (#46442508)

> The attacker HTTPS contemplates controls whether victims see SYN+ACK packets in response to their 80/tcp SYNs.

This informationally dense and adventurously worded sentence is the kind that you can only understand if you already understand it, it feels like. I certainly can't unpack it without getting my hiking gear on. Not this rainy morning, though, may the transport layer gods forgive me.

[ Parent | on HN ]

Re:HTTP Strict Transport Security (HSTS) by vluft on Wednesday December 31, 2025 @06:41AM (#46443338)

if an attacker is in the position to try to MITM TLS, they're in the position to just serve whatever they want on port 80 even if your server isn't doing that.

[ Parent | on HN ]

Re:HTTP Strict Transport Security (HSTS) by tptacek on Wednesday December 31, 2025 @12:55PM (#46446512)

They can't all be winners!

[ Parent | on HN ]

Re:HTTP Strict Transport Security (HSTS) by dxdm on Wednesday December 31, 2025 @04:06PM (#46448361)

Thanks for sending them on their way regardless. It does tend to move things forward.

[ Parent | on HN ]

Re:HTTP Strict Transport Security (HSTS) by tptacek on Wednesday December 31, 2025 @04:12PM (#46448413)

Like a good dose of dietary fiber.

[ Parent | on HN ]