But an attacker can certainly intercept HTTPS as well, and if they redirect you quick enough you'll never see the "wrong cert" errors.
No, any sort of HTTPS interception will be detected by the browser (assuming of course that the certificate authority infrastructure has not been compromised). There's no way to redirect "quick enough" to bypass certificate checking.
Of course it is detected, we are not trying to fool the PC. When I visit my personal website with a flawed certificate (for example, once I was missing the Intermediate CA) it loads the site all the same, but the lock icon shows a security verification failure.
What in HSTS protects you from that? Because it seems to me if you can get there, you can get back to http:// before the user notices the verification failure. Unless the browser simply refuses to load the site due to the verification failure, which I only see for "suspected attack sites"
Intercept 443 => Issue insecure page with new HSTS timeout => Redirect to 80 before user notices insecure page warning
But it only loads because you added an exception at some point in the past. On any normal site, it would show you a cert error and wouldn't load the page at all.
Comments
No, any sort of HTTPS interception will be detected by the browser (assuming of course that the certificate authority infrastructure has not been compromised). There's no way to redirect "quick enough" to bypass certificate checking.
Of course it is detected, we are not trying to fool the PC. When I visit my personal website with a flawed certificate (for example, once I was missing the Intermediate CA) it loads the site all the same, but the lock icon shows a security verification failure.
What in HSTS protects you from that? Because it seems to me if you can get there, you can get back to http:// before the user notices the verification failure. Unless the browser simply refuses to load the site due to the verification failure, which I only see for "suspected attack sites"
But it only loads because you added an exception at some point in the past. On any normal site, it would show you a cert error and wouldn't load the page at all.