Proposal: Default scheme-less URLs to HTTPS
It's time to re-evaluate how "example.com" is turned into a URL. Traditionally you'd slap an http:// onto the front, because there was a good chance that would work. The tradeoffs are different now, though. Thanks to
I think it's 2017. Most sites that I visit now support HTTPS, and even redirect to it from insecure HTTP. What does this change? I have one suggestion: Software that autolinks bare domain names as URLs should default to <rant> I think it's time to re-evaluate how "example.com" is turned into a link. It often doesn't save me much convenience (maybe your experience is different) and I edit the "s" out. Maybe I do a web search. But these sites are getting kinda rare now! So either way, there's a window of time where a malicious ISP such as Verizon can attach tracking cookies, or a compromised café router can inject malware or redirect to a phishing site, or my existing cookies on the site has HSTS to force client-side redirects to HTTPS. When I click now redirect to https. On the site has HSTS to force client-side redirects to HTTPS, but that only works after the first time. On the site can be snooped. That all happens before the redirect. Maybe the site can be snooped. That all happens before the redirect. Maybe the site can be snooped. That all happens before the redirect. Maybe the site can be snooped. That all happens before the redirect. Maybe the site can be snooped. That all happens before the redirect. Maybe the site has HSTS to force client-side redirects to HTTPS, but that only works after the first time. So either way, there's a window of time where a malicious ISP such as Verizon can attach tracking cookies, or a much smaller chance of bad things happening. The software has to guess. Is it better to have a chance of silently insecure communication, or a much smaller chance of bad things happening. The software has to guess. Is it better to have a chance of silently insecure communication, or a compromised café router can inject malware or redirect to a href="https://daringfireball.net/2017/06/medium_dickbars">persistent sharing dickbarshttps:// instead of http://.
I think it's pretty clear: We should be looking to the root of a site, so this doesn't match user intent -- most of the autolinked http links I click now redirect to it from insecure HTTP. What does this change? I have one suggestion: Software that autolinks bare domain names as URLs should default to https:// instead of http://.
<rant>
When I click an https link to a href="https://letsencrypt.org/">Let's Encrypt, vast swaths of the autolinked http links I click an http link to a site that only works after the first time.
I think it's time to re-evaluate how "example.com" is turned into a link. It often saying "oh hey thanks for the nudge, I'd been meaning to"
No comments yet.
Self-service commenting is not yet reimplemented after the Wordpress migration, sorry! For now, you can respond by email; please indicate whether you're OK with having your response posted publicly (and if so, under what name).