Hacker News new | ask | show | jobs
by C4K3 3023 days ago
What about websites that are on second-level domains? E.g. amazon.co.uk

Would example.amazon.co.uk then not be able to set HSTS for amazon.co.uk?
2 comments
osteele 3023 days ago
example.amazon.co.uk and amazon.co.uk are not matching domains as defined in the RFC[1] (they are not congruent).

The includeSubDomains directive[2] allows the HSTS policy set for amazon.co.uk to apply to its subdomain example.amazon.co.uk, but not vice versa.

[1] https://tools.ietf.org/html/rfc6797#section-8.2

[2] https://tools.ietf.org/html/rfc6797#page-16

link
gsnedders 3023 days ago
Yes, using pubsuffix+1 instead of TLD+1 would make way more sense.

I've asked here: https://twitter.com/gsnedders/status/974765437283119104

link
gsnedders 3023 days ago
Per the response it is using pubsuffix+1, and hence co.uk is treated as an effective TLD.
link
ademarre 3023 days ago
The public suffix is more correct than the TLD; however the fact that publicsuffix.org accepts private domains at the domain owners request weakens the mitigation.
link