HTTP Strict Transport Security Comes to Internet Explorer | Hacker News Reader

HTTP Strict Transport Security Comes to Internet Explorer

blogs.msdn.com

93 pointscleverjake29 comments

This is fantastic news! And they decided to include the Chromium HSTS Preload list too. I've submitted something like ~30 domains to the list, and having them covered in newer versions of IE automatically is a very nice thing.

How long until that list of yours is just *.gov?

A while. It takes a significant amount of effort to effect change in the IT infrastructure of every organization within the US government. (konklone does mention this in their Reddit post in /r/netsec)

Progress is progress.

Indeed. I was eager to learn more about their specific strategy to achieve it.

There's not a master plan, but there's several promising lines of work happening. Hopefully 2015 will be a fun year. Tomorrow, I'll be on Federal News Radio in the morning, preaching the gospel to DC commuters.

Link for those interested: http://www.federalnewsradio.com/?nid=1269&sid=3801434

Is there place where a (current) list of domains are stored by Chrome?

List: https://code.google.com/p/chromium/codesearch#chromium/src/n... (there are some surprising domains in there, it's not just a who's who of major sites)

Submit your domains: https://hstspreload.appspot.com/

I wonder if they plan to support Curve25519 and BLAKE2 in the browser, so developers can choose non-NIST crypto.

In terms of Curve25519: it seems so, yes. That is what CFRG's current draft recommends to the TLS Working Group for a 256-bit curve, along with the X25519 key exchange defined with it. There's a slot waiting in WebCrypto for it, too.

Not too sure about signatures yet: Ed25519 is definitely one contender, but I don't know where that'll end up.

until it's not longer tied to windows versions, ie will always be a problem

Don't know why you are downvoted but that's true. Windows versions tend to be long-lasting. If Microsoft keeps tying browsers to them, then they will always have browsers that remain behind for 5+ years.

And of course the next IE12/"Spartan" will be tied to Windows 10...so this won't change anytime soon apparently.

I don't know either, but that's HN for you. meh

It's a shame though, because the new IE isn't so bad, but while I have to develop for IE8 it's as good as useless :(

Though the only people "stuck" on IE8 are XP users, which is indeed in rapid decline.

True, but after that I'll still be stuck on IE9, and the trend will continue.

I think that's called progress :)

It would be much better progress if they could use the latest IE on whatever version of windows, rather than being forced develop for the lowest common denominator.

Chrome has it right, it's always the latest version, and firefox is better than it used to be, but even then they didn't say "sorry, you need the latest windows to use this version, here, have this 4 year old version instead"

It's ridiculous, and I can't think of one valid technical reason for it

You really can't think of a technical reason?

Now I am not involved with IE at all, but i think it's safe to assume that they are most likely using new APIs which are specific to that platform.

Now that's not an excuse, as they could write in fallbacks for platforms that don't have this, but it's definitely a valid reason.

You really can't think of a technical reason?
Now I am not involved with IE at all, but i think it's safe to assume that they are most likely using new APIs which are specific to that platform.

Now that's not an excuse, as they could write in fallbacks for platforms that don't have this, but it's definitely a valid reason.

it's a reason, but it's not a valid one. if it was then no one would write software that works on older windows versions.

> And of course the next IE12/"Spartan" will be tied to Windows 10...so this won't change anytime soon apparently.

Well, Windows 10 being a free upgrade to 7/8 users should help.

It won't remove the long tail. And telling your clients "We don't support Windows 7, you should upgrade to Windows 10" won't cut it.

Does that make Safari the last browser without a preload list for HSTS?

The preload page says Safari uses Chrome's list too: https://hstspreload.appspot.com/

Have you looked at ~/Library/Cookies/HSTS.plist?

That list doesn’t seem to be preloaded. I checked mine and it only has 187 items in it. So I guess they store the preloaded list somewhere else.

Probably that they have a different organization than the preloaded list you find elsewhere.

When you delete that HSTS.plist and restart your Safari, the same file will pop up again, containing the same entries (if you haven't modified it before). So it is reasonable to assume that the list is preloaded rather than gradually built up.

Are they really sure this feature is "exciting"? It's a welcome change for sure, but I can't quite see them beaming with joy or writhing orgasmically, simply due to an implementation of HSTS. An odd fetish, indeed.

Apparently it's becoming a thing to cheer for Microsoft when it implements a feature in its browser that others have had for years. It's like cheering for the 10th guy who crossed the finishing line instead of the first.

Firefox has had HSTS support since version 4 and Chrome has had it since 4.0.211.0. Indeed, it is great to see Microsoft do this, but too little too late?

Reply on news.ycombinator.com