Hacker News new | ask | show | jobs
by grumbelbart 163 days ago
Would that help against a man in the middle that blocks the H3 traffic to snoop the URL when the client falls back to H2?
1 comments

Every browser requires H2 connections to be encrypted so I don't think a MITM downgrading to it would reveal anything. Downgrading to H1 might do since encryption is optional there, but the proper way to prevent that is to submit your domains to the HSTS preload list so that browsers will always require encryption, regardless of protocol, no exceptions.