That would be the more useful change. If HTTPS fails (due to hostname mismatch for example), fall back to HTTP and warn, but trying HTTPS first would be fantastic and eliminate one round trip for many of my sites that are not in the HSTS preload...
Google already defaults to linking HTTPS versions of pages in its search results, which is a much better solution IMO. (Attacker can't intercept the connection to Google because of HSTS, and can't intercept the connection to the site you visit because it's a direct HTTPS link.)
Except that if the user is not visiting for the first time, then HSTS comes into play if the security headers are set, browsers can let the user know something is amiss.
We both agree that fail-open security is useless, but right now Chrome and other browsers default to going to port 80 for first visit instead of port 443. All I am asking is that the default becomes 443, and the fall-back, for first visit, is port 80.
This way I can stop running web servers on port 80 that do nothing but send a 303 with https as the protocol for that particular domain.
https://blog.mozilla.org/security/2012/11/01/preloading-hsts...
It's almost as if you didn't read my post.
Unless I can go register all my domains to be in the HSTS preload, I'd much rather Chrome tried HTTPS first, so I don't have to run a web server on port 80 that sends a 303 with https as the protocol.