[websec] Decouple HSTS's two orthogonal effects?

[Matt McCutchen <[e-mail]>]

HSTS as currently specified has two effects on browser behavior:

1. Redirecting all requests to https
2. Preventing the user from accepting bad certificates

These are completely orthogonal; it's just that webmasters who like
transport security often want both.  There are some use cases for having
one effect without the other:

1 without 2: Prevent cookie forcing
(http://scarybeastsecurity.blogspot.com/2008/11/cookie-forcing.html)
without breaking users who choose to disable all the default CAs and
accept server certificates individually.  These are the considerations I
would apply to my personal web site.

2 without 1: Keep https requests secure while some requests continue to
go unencrypted for performance.  (An alternative is to move the
unencrypted resources to a subdomain.)

I don't find either of these cases extremely compelling, but it may be
worth decoupling the two effects in accordance with general design
principles.

-- 
Matt