[markild]

Behavior like that needs to come with a huge warning label.

It would be trivial for any man-in-the-middle to block https and server http.

[AstralStorm]

This is exactly why browsers warn about such redirects. That said, this reminds me of a similar discussion on mail servers. There, STARTTLS sees much more use.

The main problem is preventing downgrade attacks. With mail it is easy to just remember the setting for every server. Not so with websites.

[michaelt]

I've seen quite a bit of criticism of it for mail servers [1] because an attacker can simply block the 'STARTTLS' message and (many) clients will silently accept that.

[1] https://www.agwa.name/blog/post/starttls_considered_harmful

[hello_there]

They could display that same "this page is not secure"-page that they display on broken certificates.