Hacker News Reader

Comment by C4K3 | Hacker News Reader

I'm seeing HSTS on https://www.myetherwallet.com/

  curl -I https://www.myetherwallet.com/
  strict-transport-security: max-age=63072000; includeSubdomains; preload

View on HN

Presumably that's fairly new. The domain hasn't made it on the HSTS preload list shipped by browsers yet, so my guess would be they started using HSTS in response to this attack.

It was addad at most a few hours earlier and as a response to the attack. That's when I checked and it did not have HSTS at that point.

I see. That is indeed bad that it wasn't there before.

Reply on news.ycombinator.com