sihil

At some (hopefully in about a year) we hope to list theguardian.com in the preloaded HSTS list that ships with the browsers. This would prevent many of these attacks. Unfortunately this is some time away as there are a handful of other subdomains on theguardian.com that are not yet HTTPS (you can only preload a domain along with all of its subdomains).

We'll also continue to look at key pinning, although that's also some time away due to the increased burden of certificate management (essentially we'd need to have at least two valid certificates, one kept offline, at all times to mitigate against another heartbleed or similar attack).

Our HSTS header is set with an expiry of a year. Provided you've visited the Guardian in the last year then you will not be able to click through an invalid certificate, nor can an attacker intercept an HTTP connection as none will be made.

At some stage we hope to list theguardian.com in the preloaded HSTS list that ships with the browsers, but unfortunately this is some time away as there are a handful of other subdomains on theguardian.com that are not yet HTTPS (you can only preload a domain along with all of its subdomains).

We're working on it!

We're in the process of switching to a dedicated certificate that only contains Guardian properties.

An interesting attack and something that we'll consider. HTTP/2 should add a significant amount of noise to this, but ultimately adding random padding to every response or padding that compresses to a consistent length would be the best solution.