[CydeWeys]

Greater use of HSTS preloading is also a good way for legitimate sites to prevent being affected by any sort of privacy crackdowns on HSTS. Preloading at the TLD level is ideal.

[ploxiln]

Preloading at the TLD level is pretty severe, will never be done for .com / .net / .org, and so will never apply to the vast majority of sites people visit. Interesting idea, but unrealistic.

[CydeWeys]

Yes, it can't be done retroactively, but it can be done for new TLDs that haven't launched yet.

[kbsletten]

If I remember correctly, Google has done this with the `.dev` TLD they own, so we're already seeing some of it.

[CydeWeys]

There are currently eight HSTS-preloaded TLDs with more on the way, including the first available for open registration coming soon.

[pingiun]

Do you have a list of them? I'm especially interested in the TLD for open registration.

[jwilk]

  .app
  .bank
  .chrome
  .dev
  .foo
  .google
  .insurance
  .page

Source: https://github.com/chromium/chromium/raw/master/net/http/tra... (grep for TLD)

[CydeWeys]

See https://registry.google