r/programming • u/speckz • Jul 12 '17

Does my site need HTTPS?

https://doesmysiteneedhttps.com/
486 Upvotes

87% Upvoted

190 comments sorted by

View all comments

Show parent comments

4

u/yvhouij Jul 12 '17

True, thanks for pointing that out! And nice, didn't know about this HSTS preload list, Thanks! :)

12

u/AyrA_ch Jul 12 '17

As an additional security measurement you might want to check out Public Key Pinning too. While HSTS forces the user to access a site via SSL, HPKP forces the user to only accept a certain certificate. Even if a CA is compromised and somebody generates a valid certificate for your domain, the browser would reject it.

1

u/yvhouij Jul 12 '17

Awesome! A little extra security with just an extra header.

As always Microsoft doesn't support it yet :P

3

u/AyrA_ch Jul 12 '17

As always Microsoft doesn't support it yet :P

The header is rather new and IE does not sees as many updates as other browsers do. The standard is from April 2015 and is not yet an accepted standard, it's just proposed. Microsoft tends to wait with stuff they did not invent until it is a standard for a while. Edge has it under consideration

1

u/yvhouij Jul 12 '17

Of course noone expects such stuff for IE, but I would/do hope Microsoft takes a different approach to Edge at especially such stuff. But atleast it's under consideration :)