undefined | Better HN

0 pointsmehrdadn5y ago0 comments

Thanks, but then what do I do about HTTP-only sites? Why can't it default to HTTPS and then auto-fallback to HTTP when HTTPS connections fail for sites that aren't in the known-HTTPS list? It seems like a logical thing to do instead of just going straight to HTTP.

0 comments

tialaramex5y ago

This only helps you at all against passive adversaries.

An active adversary will just cheerfully block that HTTPS connection because you'll fall back to insecure silently.

mehrdadnOP5y ago

I fully understand that and that's still clearly still better than going straight to HTTP, which it's already doing.

j / k navigate · click thread line to collapse

0 comments

tialaramex5y ago

This only helps you at all against passive adversaries.

An active adversary will just cheerfully block that HTTPS connection because you'll fall back to insecure silently.

mehrdadnOP5y ago

I fully understand that and that's still clearly still better than going straight to HTTP, which it's already doing.

j / k navigate · click thread line to collapse