Comment on Websites Must Use HSTS in Order to Be SecureComments−wglb12yOne drastic solution if your web site has lots of IE users: Simply don't answer the phone on port 80.[Edit] Duh. As agentS points out, this won't work.−agentS12yThe attacker will merely reply on your behalf. Does not improve the situation.−sliverstorm12yI don't think that's helpful. Perhaps more along the lines of putting a flat redirect on port 80, with no content.(It sounds like this attack depends on a complete version of the website being available over port 80)−agwa12y(It sounds like this attack depends on a complete version of the website being available over port 80)No, it doesn't. An attacker can always connect to the website over HTTPS and proxy the content to the victim over port 80.−sliverstorm12yHmm, yes, of course you are correct. I'm not sure why I was thinking that wouldn't be a risk.−awj12yThe real drastic solution is to disable HTTP for the entire internet and stop implicitly trusting the identity of servers. Until we decide that is worthwhile we're just going to be patching a leaky boat.
Comments
One drastic solution if your web site has lots of IE users: Simply don't answer the phone on port 80.
[Edit] Duh. As agentS points out, this won't work.
The attacker will merely reply on your behalf. Does not improve the situation.
I don't think that's helpful. Perhaps more along the lines of putting a flat redirect on port 80, with no content.
(It sounds like this attack depends on a complete version of the website being available over port 80)
No, it doesn't. An attacker can always connect to the website over HTTPS and proxy the content to the victim over port 80.
Hmm, yes, of course you are correct. I'm not sure why I was thinking that wouldn't be a risk.
The real drastic solution is to disable HTTP for the entire internet and stop implicitly trusting the identity of servers. Until we decide that is worthwhile we're just going to be patching a leaky boat.