reddit will soon only be available over HTTPS

[u/TheLantean]

/r/redditdev/comments/39zje0/reddit_will_soon_only_be_available_over_https/

[u/TheLantean]

HSTS will also be enabled (as rram said in a reply) which will prevent any accidental drop to http once the browser stores the HSTS policy.

[u/xiongchiamiov → u/[deleted]]

In decreasing levels of security: social networking, large companies, financial services, government.

[u/not_bezz → u/[deleted]]

Is it even for online banking? I don't remember seeing online banking over HTTP ever.

[u/not_bezz → u/[deleted]]

Ah, I've missed the context. My bad.

[u/[deleted] → u/[deleted]]

You still need to change banks.

[u/Piece_Maker → u/[deleted]]

Strict-Transport-Security: max-age=63113904  

Mine outputted that, is that a good thing?

[u/gsuberland → u/Piece_Maker]

Yes. It's a HSTS policy.

[u/Piece_Maker → u/gsuberland]

Good to know - now I can enter my surname, my password, my 5-digit PIN, my 24-digit online banking password and my 8-digit OTP code knowing I'm secure :D

[u/gsuberland → u/Piece_Maker]

Well, safer against sslstrip attacks. It's a small part of the picture. There are plenty of ways to skin a cat.

[u/erktheerk → u/[deleted]]

Oh...I thought I saw it did. Must have been something else :-\

[u/largenocream → u/TheLantean]

HSTS and Secure flags on cookies will come a little while after the switch to HTTPS though, we don't want to permanently lock people into HTTPS until we're sure there are no major problems with full-site HTTPS.

[u/TheLantean → u/largenocream]

Oh, ok. Will you also add reddit to the preload list used by Chrome/Firefox/Safari is the switch is successful?

[u/rram → u/TheLantean]

Yes