@fennix : here's a site that may have more than average visitors.

@jwildeboer @rmondello

@fennix : the problem is NOT that people type http:// followed by a domain name in their browser's address bar.

Instead, the problem is that they type:

rmondello.com

or

cisco.com

etc.

in the address bar of their browser.

Only if the website *correctly* (1) supports HSTS *and* you've visited the site sufficiently recently using *this* browser *and* browser has not lost its HSTS database (for frivilous reasons or whatever), https is enforced.

(1) Not, one example if many, Rmondello.com (see https://internet.nl/site/rmondello.com/3117596/#sitetls).

@jwildeboer @rmondello

Aha, takže to je kvůli #HSTS a includeSubDomains.
https://www.rfc-editor.org/rfc/rfc6797#section-6.1.2

Je fajn, když člověk u nějaké IT magie zjistí, proč se to chová, jak se to chová.

@valorin : thanks, I wasn't aware of the existence of an RFC for a default change-password file!

For those interested: https://internet.nl checks any webserver for, among a lot of other things, the existence of the security.txt file (it shows its results in English, you don't have to know what Goudse kaas, stroopwafels and hagelslag mean ;-)

Best practices: https://internet.nl checks for lawful requirements of Dutch (Netherlands) governmental websites. After more than a year since that law came into effect, still a lot of govt. websites do not fully comply. In particular, many have still not set up HSTS correctly, such as Almere (https://internet.nl/site/almere.nl/2957791/ - not detected by https://developer.mozilla.org/en-US/observatory/analyze?host=almere.nl).

Unfortunately HSTS (which too often does not work) still has to help internet users, as browsers still do not *enforce* https connections in a sensible way (https://infosec.exchange/@ErikvanStraten/113045241408077702).

(Coen Wesselman @wsslmn : do you like the idea of adding a check for "/.well-known/change-password", and if so, is that something you could ask to be included in the tests by internet.nl?)

@textualdeviance wrote, among other things:

« Sudden revolutions come with obscenely high body counts of innocent civilians. »

That is not necessarily true, in for example the following cases:

https://en.wikipedia.org/wiki/Velvet_Revolution

A revolution that STOPS killing must take place #NOW. The anihilation of Palestinians is simply unacceptable, in particular because western countries condone, support or even encourage it. At some point the governments of the USA, NL and others must stop following orders from their Zionist sponsors, in order to not make them EVEN MORE complicit to genocide.

Personally I'm "fighting" for a safer internet; fixing tech does not have to involve bloodshed at all (although big tech and leeches like https://safer.io/ will lose income). Such as:

• By insisting on a system where internet users can distinguish betwee fake and authentic websites (see https://infosec.exchange/@ErikvanStraten/113079966331873386);

• By providing strong arguments why "Chatcontrol" (governments scanning every smartphone looking for Child Sexual Abuse Material - and what not) will not protect a single child - on the contrary (https://infosec.exchange/@ErikvanStraten/113075518670257012; chatcontrol is *not* just a privacy risk);

• By warning for passkeys (https://infosec.exchange/@ErikvanStraten/113058944497262936) and suggesting better alternatives;

• By warning for risks such as when unlocking the screen of an iPhone/iPad with a PIN (https://infosec.exchange/@ErikvanStraten/113053761440539290);

• By warning for security measures that are easily bypassed, such as 2FA/MFA (using SMS, voice, or TOTP "Authenticator" apps including Microsoft's using "number matching");

• Et cetera.

@0xabad1dea

@pmevzek : all those "terrific" new Google HSTS preload TLD' s [1] do one terific job for sure: facilitate cybercrime by confusing all but expert internet users.

They were created for purely commercial purposes. Say someone has registered "microsoft.com". Now *YOU* have the possibility to register "microsoft.dev"! Unless another criminal is faster than you, or Microsoft, or a registrar who speculates that they can resell it for a higher price. Guess who wins most and who gets to pay in the end. It is sick.

[1] https://www.thesslstore.com/blog/google-forcing-https-connections-45-tlds-hsts/

W.r.t. the supposed advantage of https over http: It is irrelevant if a connection to a criminal website (usually impersonating a real one) uses http or https.

To reduce the risks when deciding to trust a website, an internet user (who understands the necessity) needs to know at least the following things:

(1) Who apparently *owns* a website;

(2) The probability that the owner is who they claim te be.

Big tech deliberately frustrates this process using lies: see https://infosec.exchange/@ErikvanStraten/112914047006977222 for more info.

Apart from junk-TLD's, the "good old" TLD's are *not* on the HSTS preload list. For added security each .com (and a zillion other TLD's) websites would have to register to the preload list - which does not scale.

To be honest, HSTS has a slight advantage in most (or all?) browsers: *if* the browser "knows" that a website insists on the use of https, any certificate warning becomes a fatal error (the user cannot tap "connect anyway" or something like that).

*IF* that is a good idea in each and every case, then browsers could enforce this *without* HSTS (with or without preload). Or permit bypasses in specific cases, such as that a certificate has expired - for example limited to 1 week.

Anyway, everyone could do me (not just me b.t.w.) a big favor if they'd stop promoting flawed alternatives to "https only".

And, an even bigger favor, that everyone stops defending the one-size-fits-all way how browsers treat certificates. Their makers do their very best to eliminate the possibilities that internet users have to distinguish between websites with known versus unknown (anonymous) owners.

Note: knowing who owns a website does not warant reliability. However, not knowing who owns a website may mean that the owner *does no want you to know* who they are. Guess why.

@lucasmz @freddy