Hacker News Reader

Comment by jbk | Hacker News Reader

IE. But that is soon over.

You should see SSL from Google though.

Because of lacking SNI support? You can try an Ajax request or loading a picture over SSL and then redirect with JS if it doesn't fail. If the SSL site serves HSTS headers, all SNI supporting browsers will in the future default to HTTPS independently of the kludgey redirect (because all browsers that support HSTS also support SNI).

Sure. An unconditional redirect would be better, but that requires a dedicated IP

Good idea.

You can also set the favicon path to https, and put hsts headers on it. No JavaScript required.

But people with old IE won’t get a favicon that way

> You can try an Ajax request or loading a picture over SSL and then redirect with JS if it doesn't fail.

Neat idea, but wouldn't this still be exposed to ISP-level attacks? Since the user is still loading the page initially in plain HTTP, so the ISP could still inject code, remove the JS redirect, etc.

Yes, no redirect can protect the user from that. In fact, not even completely disabling HTTP can - the ISP can respond on port 80 anyway. But it can protect them if they open it on a safe connection and then bookmark the page, or keep the tab open, or send the link to someone else, and then use that link on an unsafe connection.

Or using HSTS (especially with HSTS preloading)

https://www.w3.org/TR/upgrade-insecure-requests/#feature-det...

Is there an existing ticket for redirects?

Yes. But not in the VLC tracker, because it is not a VLC issue.

Reply on news.ycombinator.com