News for hackers. Stuff that matters.

A comment on What we give away when we log on to a public Wi-Fi network. Parent comment

Re:What we give away when we log on to a public Wi-Fi network by iancarroll on Saturday October 18, 2014 @05:25PM (#8476372)
https://hstspreload.appspot.com/ says they don't use HSTS as a preload. They should...
[ Parent | on HN ]
Re:What we give away when we log on to a public Wi-Fi network by Wilya on Saturday October 18, 2014 @05:40PM (#8476414)
Facebook seems to be doing some client sniffing to decide whether to set the headers..

In my browser (FF nightly), I see the HSTS header, with the value: "max-age=15552000; preload"

If I do a request with curl, no header... (which is probably what this app sees).

I don't have a clue why they are doing that, though. Not that curl would do something with the HSTS header anyway, but still...

[ Parent | on HN ]
Re:What we give away when we log on to a public Wi-Fi network by zokier on Saturday October 18, 2014 @05:49PM (#8476444)
Facebook has HSTS preload on www.facebook.com, but not on the redirect from facebook.com->www.facebook.com. I suppose they have their reasons
[ Parent | on HN ]
Re:What we give away when we log on to a public Wi-Fi network by ma2rten on Sunday October 19, 2014 @01:11AM (#8477274)
Google.com also doesn't seem to have it.
[ Parent | on HN ]
Re:What we give away when we log on to a public Wi-Fi network by iancarroll on Monday October 20, 2014 @07:34AM (#8481575)
Google only uses a certificate pin and doesn't force SSL. Sadly.
[ Parent | on HN ]