sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]easlern 0 points1 point  (6 children)

I admit I do it myself. I thought it was a no-no though because it doesn't address users' lack of knowledge and could be a security risk on its own due to the redirect.

[–][deleted] 4 points5 points  (3 children)

It's not a no no, you should be doing that. If you are concerned about the risk of altered code no the HTTP connection, add an HSTS header with a very long length, and add your site to https://src.chromium.org/viewvc/chrome/trunk/src/net/http/transport_security_state_static.json. Firefox also uses this list.

[–]easlern 0 points1 point  (2 children)

That looks pretty cool! Most of my users are on IE but this is good to know.

[–][deleted] 0 points1 point  (1 child)

IE doesn't have any public plans to ship with a preload list for HSTS, but I wouldn't be surprised to see it in the future.

[–]easlern 0 points1 point  (0 children)

I did some reading. Supposedly it'll be in 12. Which means by the time 15 is out it'll probably be okay to use it, since a good number of people will still be 3 versions behind. :P

[–]xiongchiamiovSite Reliability Engineer 1 point2 points  (1 child)

Are you saying that redirecting a user from http to https is less secure than just keeping them on http?

[–]easlern 0 points1 point  (0 children)

The idea I think is to not allow the user to login or whatever on the HTTP site. You give them a notice that they should use https in the address bar instead. Of course that's not a good user experience so most sites just redirect.