Top all-time · #18206
Michael Coates
Personal blog · michael-coates.blogspot.comsecurityweb
Michael Coates writes A Journey in Security, a personal blog at michael-coates.blogspot.com about security and web. Since 2010, 4 different Hacker News readers have linked it 5 times. The last post was in 2015, but the archive is still widely read.
Too few sampled comments (2) to say how often HN recommends it.?
Why HN links it
HN readers link this blog for web security posts on moving to HTTPS, HSTS, and a man-in-the-middle issue on mobile Facebook caused by a missing HSTS header.
Summarised by Claude from a sample of 2 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
What Hacker News says?
Why are you going to lose Advertiser money? That's bogus. Why does Google profit from HTTPS over HTTP? Amazon.com (HTTP) redirects to (HTTPS), via a 301 - that's Permanent Redirection. This also isn't Mozilla, but Chrome. And honestly i don't even know where to begin, but you should look into HSTS, and the vulnerabilities that exist transitioning between the two modes[1], as well as looking at the issues (data bleed…
Comment linking /2009/02/compromising-http-to-https-redirects.html
on “Moving Towards a More Secure Web”Submitted Securely Storing Opt-Out Email Addresses as a story · 8 points
HN discussionIt's important to note that even if the HSTS header was present on the mobile site, the exploit would still be possible since many mobile browsers do not support HSTS[1]. [1] http://michael-coates.blogspot.com/2013/09/security-capabili...
Comment linking /2013/09/security-capabilities-comparison-hsts.html
on “Man-in-the-middle attack on Mobile Facebook possible due to lack of HSTS header”Submitted The Irony - Black Hat Video Stream Hack as a story · 2 points
HN discussionSubmitted Application Security: HTML5, Local Storage, and XSS as a story · 1 points
HN discussion