Comment

Comment by dfabulich

There's no link to more technical detail. What happens when the site I type in the URL bar doesn't support HTTPS? Will it error out? (with a timeout?) Or will it automatically fallback to trying HTTP? (In that case, could a MITM block HTTPS to force the browser to try to downgrade?)

EDIT: I see that the article says it will fall back, but Chrome Canary has options in chrome://flags, and it's not clear which option they picked.

> Omnibox - Use HTTPS as the default protocol for navigations

> Use HTTPS as the default protocol when the user types a URL without a protocol in the omnibox such as 'example.com'. Presently, such an entry navigates to http://example.com. When this feature is enabled, it will navigate to https://example.com if the HTTPS URL is available. If Chrome can't determine the availability of the HTTPS URL within the timeout, it will fall back to the HTTP URL.

The options are: Enabled, Enabled 3 second timeout, Enabled 10 second timeout, and Disabled.

So how will it work, exactly?

parent dfabulich 5 years ago

Discussion

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton