Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Huh, never had a need for that. Most sites either they auto redirect to the https version, or they dont have one, eg in this case. Don't really see the need.




HTTPS-only mode doesn't do the initial HTTP request if HTTPS is available. This prevents downgrade attacks, prevents leaking private information such as the entire URLs (many email tracking links default to HTTP so you leak the token contained in there) or if the website supports it even the domain name you access. It's not "needed", sometimes it breaks things (HTTP-only website but with HTTPS port opened), sometimes it fixes things (HTTPS-only website with HTTP-port opened).

It doesn't matter if the site is trying to redirect you to an encrypted connection. An attacker in the middle could send any data in the unencrypted response. It's better to just skip it.



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: