Hacker News new | ask | show | jobs
by resoluteteeth 2336 days ago
When you first access a site, unless the site is using HSTS you are going to go to an insecure version so a mitm can proxy the request and remove tls or redirect you to another site. This is what is known as "https stripping."
1 comments

You are talking about "HSTS Preload", HSTS doesn't do anything on first access.
HSTS helps unless you are always on compromised networks or the site uses short TTLs. Even without preloading most people are probably not accessing their bank for the first time ever on a malicious network.