Hacker News Reader

Comment by skrebbel | Hacker News Reader

refresh my understanding, if i manually type "https" into the address bar, then i can't be MitM'ed through lack of HSTS, right?

View on HN

correct, assuming you don't let yourself get tricked into trying without https.

Which, if my experience pentesting is any indication, most people will.

This. The question of public WiFi often isn’t “can you keep your comms secure if you try”, but “will my average user who just wants stuff to work While traveling be better off on their own mobile hotspot or connecting to dodgy free WiFi?” Unquestionably, they’ll be better off avoiding public WiFi.

Applications like Outlook will warn you about cert problems but still let you bypass them. This could be better on app side, but it’s a reality end users deal with. And when/if IT knows about it, it’s because the user complains that their laptop/Outlook is broken. The avg business user doesn't think about cert chains.

You could be.

If you are, you’ll get a message that the very isn’t valid.

Unless there’s an attack on cert providers or someone adds a cert to your device.

The cert approach can be seen in some corporate environments.

> Unless there’s an attack on cert providers or someone adds a cert to your device.

How does HSTS help with that?

HSTS has a certificate pinning extension, but base HSTS wouldn't.

>HSTS has a certificate pinning extension

You mean HPKP? AFAIK it isn't an extension, but rather another feature. Also, it's deprecated at this point.

Isn't certificate pinning deprecated for regular web traffic?

Reply on news.ycombinator.com