Re:Challenge HN: Break my in-browser crypto for $1000
by ryalfalpha on Wednesday May 29, 2013 @08:42PM
(#5790253)
Someday ;)
Perhaps there could be open whitelists where sites could nominate their sites as 'https only'. Wouldn't even need to be built into the browsers, could just be a thing people do when they launch a clean browser install, hit up https://blahsitelist.com and click a button that fires off https requests to all of those sites which would cache the HTST header? (I've only stumbled on HTST headers today, so I may be overly flamboyant as to their usefulness)
Although, come to think of it, isn't that just basically what the HttpsEverywhere extension does?
I like the kind of pinning and preloading that chrome does but it's such a tiny gesture compared to the size of the internet, and nobody else seems to be trying to deploy better security.