News for hackers. Stuff that matters.

A comment on Is Your Site HSTS Enabled?. Parent comment

Re:Is Your Site HSTS Enabled? by gellerb on Friday April 25, 2014 @12:03PM (#7647294)
Yeah. I noticed that paypal.com has a max-age of 4 hours.
[ Parent | on HN ]
Re:Is Your Site HSTS Enabled? by rhoml on Friday April 25, 2014 @01:06PM (#7647699)
Maybe the first step to avoid issues is to enforce SSL which is easy on any webserver before going HSTS.
[ Parent | on HN ]
Re:Is Your Site HSTS Enabled? by d0ugie on Friday April 25, 2014 @01:50PM (#7647980)
Is there any downside, when using SSL, in enabling perfect forward secrecy?
[ Parent | on HN ]
Re:Is Your Site HSTS Enabled? by JshWright on Friday April 25, 2014 @02:13PM (#7648145)
Make sure you're using an SSL library that support ECDHE cipher suites... the non EC suites are very slow.
[ Parent | on HN ]