News for hackers. Stuff that matters.

A comment on Deprecating Non-Secure HTTP. Parent comment

Re:Deprecating Non-Secure HTTP by dukky on Friday May 01, 2015 @07:57AM (#9470728)
But https doesn't 'let you know for sure that the content is exactly what the owner of the site intended' as it doesn't protect you from xss
[ Parent | on HN ]
Re:Deprecating Non-Secure HTTP by abraham on Friday May 01, 2015 @11:56AM (#9472297)
Than you fix the XSS vulnerabilities and implement CSP. Shitty security practices is not an excuse for more shitty security practices. https://developer.mozilla.org/en-US/docs/Web/Security/CSP
[ Parent | on HN ]