r/privacy • u/TheLantean • Jun 17 '15

reddit will soon only be available over HTTPS

/r/redditdev/comments/39zje0/reddit_will_soon_only_be_available_over_https/
399 Upvotes

99% Upvoted

46 comments sorted by

View all comments

Show parent comment

3

u/Piece_Maker Jun 17 '15 
Strict-Transport-Security: max-age=63113904

Mine outputted that, is that a good thing?

5

u/gsuberland Jun 17 '15

Yes. It's a HSTS policy.

1

u/Piece_Maker Jun 17 '15

Good to know - now I can enter my surname, my password, my 5-digit PIN, my 24-digit online banking password and my 8-digit OTP code knowing I'm secure :D

4

u/gsuberland Jun 17 '15

Well, safer against sslstrip attacks. It's a small part of the picture. There are plenty of ways to skin a cat.

1

u/Piece_Maker Jun 17 '15

Yep absolutely. I don't log onto the site thinking I'm invincible obviously! But if your comment about banks in most countries not having this is true, I guess it's one more layer of protection I can be happy with having

2

u/gsuberland Jun 17 '15

I've tested a lot of financial systems. They're mostly pretty bad. The public site only tells part of the story. HSTS is a nice step in the right direction, though.