Skip to main content
Information Security

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

5
  • 2
    You're describing the "SSL stripping" attack. Browsers have since implemented HTTP Strict Transport Security (HSTS) as a countermeasure, including HSTS preload lists and HTTPS Everywhere (essentially a third-party HSTS preload list). Commented Feb 19, 2015 at 0:43
  • 1
    @tepples HSTS is worse than useless, as it can also be stripped while providing a false sense of security of server owners. Commented Feb 19, 2015 at 2:48
  • 1
    @Alice, What do you mean HSTS can be stripped? Commented Mar 28, 2015 at 23:56
  • 2
    @Dogeatcatworld, The question is asking why do browsers change the user's request (typing in the url) from web.com to http://web.com instead of https://web.com? Commented Mar 28, 2015 at 23:58
  • 3
    @Pacerier The first time a user follows a link using the https: scheme to a site using HSTS that isn't in the preload list, an HTTP proxy rewriting all links can rewrite the link to instead use the http: scheme. That's why the preload list exists, but no preload list is exhaustive. So long as the user stays behind stripping proxies, visits only sites not in the browser's preload list, never manually keys in the https: scheme, and never notices the lack of a lock icon in the right place, the user is unaware of any attack. Commented May 1, 2015 at 15:52