Re: HSTS preload flaw

[Eric Mill <[e-mail]>]

On Sun, Feb 9, 2020 at 6:51 PM Austin Wright <[e-mail]> wrote:

> If encrypted connections are important to you as a server operator, it
> seems the only foolproof way to avoid plaintext communication is don’t
> listen on port 80.
>

Without getting into the overall issue, I just want to note for readers of
the thread - server operators can't avoid plaintext communication by
clients by not listening on port 80. Clients can attempt to initiate a
connection to a hostname over port 80 whether or not the "real" server is
listening on port 80, and that connection can be interfered with by a
malicious network actor. That's why HSTS exists - to provide some kind of
signal to the client that they should never bother even trying to make that
connection.