741 reputation
411
bio website
location
age
visits member for 2 years, 8 months
seen Jul 17 at 17:54

Jun
7
comment Why does 301 redirect work for http but not for https?
Indeed, this isn't the case. For plain HTTP, you don't need a cert, and GoDaddy can certainly redirect as main domains from example.com to www.example.com as they want (or anything else that points to their initial host). For HTTPS, they'd need to set up a cert valid for all redirected hosts on their redirection machine, which would have more constraints for all parties. You'd be able to achieve what you want if you handled the redirection yourself (if both IP addresses were under your control).
Jun
7
comment Why does 301 redirect work for http but not for https?
Do mywebsite.com and www.mywebsite.com point to the same IP address (try with nslookup), or it mywebsite.com handled by a redirection service from your registrar?
Jun
7
answered Why does 301 redirect work for http but not for https?
Feb
25
comment How to prevent access to website without SSL connection?
@AnnonomusPerson, that's exactly the same principle and that's what the rewrite rule from HTTP to HTTPS does. Whether you do it programmatically or by configuration doesn't matter, it's still a redirection with an initial request in plain HTTP, which presents the same problem.
Nov
24
awarded  Yearling
Oct
28
awarded  Announcer
May
6
awarded  Nice Answer
Nov
24
awarded  Yearling
Aug
1
comment What books or articles are must reads for learning about SSL management
Which specific aspect of managing certificates for SSL are you interested in? Is it more about how certificates work in general or perhaps some best practices (in terms of system administration)? Is it a wider question in terms of how to set up an HTTPS website properly?
Jul
30
comment Self signed SSL certificate with a wild card - works for sub domain, fails for the main domain
Which tool do you use to generate your self-signed certificate?
Jul
30
answered Self signed SSL certificate with a wild card - works for sub domain, fails for the main domain
Jul
27
comment https (SSL) instead of http for mobile users
@user1332729, after re-reading your comment at the top, this should be of interest (if you haven't seen it already from the other question I've linked to).
Jul
27
comment https (SSL) instead of http for mobile users
@user1332729, indeed, that makes sense if their CDN have the same URL mapping between http:// and https:// (I was just pointing out that they were offering https:// here).
Jul
26
comment https (SSL) instead of http for mobile users
No, they can't. I connect to my bank website using https://mybank/ directly, and I don't ignore certificate warnings: sslstrip doesn't work here. Again, sslstrip attacks the content obtained via plain HTTP, to prevent you from getting the https:// links (or rediction). If you expect HTTPS for a site, you're OK. Again, that's why HSTS (HTTP Strict Transport Security) is being deployed, to make sure browser expect HTTPS when it's available.
Jul
26
comment https (SSL) instead of http for mobile users
From the sslstrip page: "It will transparently hijack HTTP traffic on a network, watch for HTTPS links and redirects, then map those links into either look-alike HTTP links or homograph-similar HTTPS links.". That's an attack against upgrades and initial HTTP content, not against HTTPS. That's why HSTS is useful.
Jul
26
comment https (SSL) instead of http for mobile users
You don't seem to know how sslstrip works. It MITM-attacks the HTTP connection before getting to HTTPS, for those who rely on an upgrade, or spoofs the cert with its own (which you won't trust). If you expect HTTPS to start with, and if you get a certificate you trust, you're OK.
Jul
26
answered https (SSL) instead of http for mobile users
Jul
26
comment https (SSL) instead of http for mobile users
HTTPS is not vulnerable to MITM attacks, if the user has normal certificate verification in place. That's the whole point.
Jul
24
answered How to reliably determine server stack of a site (eg .Net vs Open Source)
Jul
23
awarded  Constituent