Hacker News new | ask | show | jobs
by tzakrajs 3997 days ago
Also, the browser can opt into HTTPS by using a plugin such as HTTPS Everywhere.
2 comments

All of these defenses post-date sslstrip/sslsniff, and if you look at mailing list conversations in the early days of HTTPS Everywhere, you can see that it was developed as a direct response to these attacks.
All HTTPS all the time is the only real solution. Both those band aids rely on distributing rules to browsers describing when to use HTTPS with what sites. That is totally unscalable, not to mention only as secure as the ruleset distribution channel.