icansearch
Joined 8 years ago
Karma
36
Submissions
7
Member since
Mar 12
Joined 8 years ago
(https://github.com/github-community/community/discussions/77... - released by end of June)
Easy enough to separate them out of the rice after freezing too.
With HSTS, once they've connected to the server over HTTPS once (e.g. at home), every connection from that browser will be immediately upgraded to HTTPS before even trying HTTP.
Your suggestion is valid - as HSTS is only delivered over HTTPS - and the upgrade is still required the first time.
See Firesheep for an example of how HTTP can be intercepted - https://en.wikipedia.org/wiki/Firesheep
Happy to have a level of group synchronisation out of HR's systems, but certainly would not give them the ability to manage the high-power users.