Post #3994351
2026-07-21 19:37 UTC
@BucciaBuccia@mastodon.social @rallias@hax.social @sarahjamielewis@mastodon.social
"You can just enable HTTPS-only mode."
Why?
Any site that has https should be re-writing.
Some sites are http only and don't need https as you are not logging on and they are innocuous.
Also a public WiFi or poisoned DNS can MitM attack HTTPS.
There is no point to a plug-in such as https everywhere or HTTPS-only mode. Any sane HTTPS site doesn't accept HTTP!
Replies (1)
-
@rallias@hax.social 2026-07-21 19:40
@raymaccarthy@mastodon.ie Also a public WiFi or poisoned DNS can MitM attack HTTPS. If you're clicking to ignore certificate validation failures, you're creating your own attack surface. You'd be better off not creating your own attack surface than adding another layer. @BucciaBuccia@mastodon.social @sarahjamielewis@mastodon.social