Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

They might use user-agent sniffing and decide not to redirect ie that old to https?


If you're already doing a MITM attack, then you can edit the user agent string as well. Anything in the initial unsecure HTTP request is fair game.


If you're doing a MITM attack, Google's behavior doesn't matter; you can handle all the http requests and send them to Google (or whoever) as https and fix up all the internal links etc. If the user's browser is willing to go to google.com with http, it's probably ancient (no preloaded HSTS lists).

If you're actually on an ancient browser, Google's behavior does matter --- if they send you to https and don't work with ancient SSL/TLS stacks, then you can't use their products. For anything with a login, that seems reasonable, but for search, it seems pretty useful to allow HTTP for ancient browsers, because it's very hard to use the web without search.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: