News for hackers. Stuff that matters.

A comment on Securing access to Wikimedia sites with HTTPS by default. Parent comment

Re:Securing access to Wikimedia sites with HTTPS by default by _kshakir on Friday June 12, 2015 @12:33PM (#9706934) 

  * HSTS requires HTTPS connections  
  * Internet.org (currently) requires HTTP only [1]  
  * But Wikipedia is a member of Internet.org [2]
I'm curious how Wikipedia will handle this. Perhaps allowing Facebook to MITM?

Or maybe the security mentioned in the original article isn't intended for those who can't afford it[3].

  [1] https://developers.facebook.com/docs/internet-org/platform-technical-guidelines
  [2] https://internet.org/press/introducing-the-internet-dot-org-app
  [3] https://en.wikipedia.org/wiki/Wikipedia_Zero
[ Parent | on HN ]
Re:Securing access to Wikimedia sites with HTTPS by default by MichaelGG on Friday June 12, 2015 @02:32PM (#9707707)
HSTS only works after you connect over HTTPS. If you can only access a site over HTTP, HSTS doesn't do anything. So maybe people hitting WP from Internet.org can never get it over HTTPS in the first place?
[ Parent | on HN ]