But then, if I'm MITMing you, I can just silently keep you on www, without SSL, ... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

XMPPwocky on April 8, 2016 | parent | context | favorite | on: WordPress.com turns on HTTPS encryption for all we...

But then, if I'm MITMing you, I can just silently keep you on www, without SSL, without caring about HSTS or anything.

iancarroll on April 9, 2016 [–]

If WordPress enables (preloaded) HSTS, that would not matter.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact