> All he had to do was visit one website. Any website.
The author directly contradicts the headline used here:
> The website must use “clear text” which means the URL starts with “http” not “https.”
The author directly contradicts the headline used here:
> The website must use “clear text” which means the URL starts with “http” not “https.”
Both wind up eventually to the same place, but the first redirects to the second.
That can be a link, it can be an old bookmark, etc.
Worse if it was a targeted ad, the https:// link could be just a redirect back to an http:// link, something the browser probably has no trouble doing.
Doesn't HSTS prevent exactly this? Sure, not every website implements it, but the most visited ones overwhelmingly do - it's certainly misleading to say "any website" in that context.
Doesn't even have to be a link. If you type addresses like most be people do (ie. without https://), the browser is going to attempt http first. So any manually typed in address will be vulnerable as well.
That's trivially disproven by typing "example.com" in the address bar and hitting enter. Both chrome and firefox goes to the http version not the https version, even though the https version is available.
Even if that were true though, an attacker in a position to perform an MITM attack can also block the https connection from going through, forcing the browser to make a http connection.