HTTPS rewriting is bypassed if DNS root is explicitly specified
|Reported by:||NYKevin||Owned by:||pde|
|Component:||HTTPS Everywhere/EFF-HTTPS Everywhere||Version:|
|Cc:||mikeperry, aaronsw||Actual Points:|
If you go to a URL such as http://www.google.com./ HTTPS-Everywhere will *not* switch to HTTPS. This is a legal DNS value, technically but not practically distinct from http://www.google.com/ and as such, it should be handled similarly.
On the other hand, it is sometimes useful to have an "escape hatch" to disable HTTPS rewriting for just one pageload (e.g. Google's doodles don't show under HTTPS in my experience). However, that hatch ought to have better affordances if it's to continue existing at all. As it is, this is potentially a social engineering vulnerability (although I'm not sure how practical such a hypothetical attack might be; it would probably need to be targeted at a particular individual).
Change History (8)
comment:6 Changed 5 years ago by pde
- Owner changed from pde to dtauerbach
- Status changed from new to assigned