Approved HTTP Strict Transport Security (HSTS)

[Kieran]

Since I started playing with HTTP and HTTPS on my own server for some extra security and fun, I thought it would be nice to have HSTS on the r4p3 forum too.

It makes it more secure and will prevent cookie hijacking and downgrade attacks.
So you'll always be secure on R4P3.
Additionally, an idea would be to go a step further and use HSTS preload. https://hstspreload.org/

Adding HSTS is really easy so I can't really see anything against it.

Also, this would get R4P3 the A+ on SSLLabs
https://www.ssllabs.com/ssltest/analyze.html?d=r4p3.net&s=104.31.94.226&hideResults=on&latest

 

[Kleberstoff]

Since I started playing with HTTP and HTTPS on my own server for some extra security and fun, I thought it would be nice to have HSTS on the r4p3 forum too.

It makes it more secure and will prevent cookie hijacking and downgrade attacks.
So you'll always be secure on R4P3.
Additionally, an idea would be to go a step further and use HSTS preload. https://hstspreload.org/

Adding HSTS is really easy so I can't really see anything against it.

Also, this would get R4P3 the A+ on SSLLabs
https://www.ssllabs.com/ssltest/analyze.html?d=r4p3.net&s=104.31.94.226&hideResults=on&latest

I don't see anything that would go against it. I would love to hear @Asphyxia's Opinion on it as well.

 

[Kieran]

R4P3 team, yes/no? Reason?

 

[Asphyxia]

We are also looking to add DNSSEC: http://dnssec-debugger.verisignlabs.com/r4p3.net#

We now have HSTS, see here: https://www.ssllabs.com/ssltest/analyze.html?d=r4p3.net&hideResults=on

 

[Kieran]

We are also looking to add DNSSEC: http://dnssec-debugger.verisignlabs.com/r4p3.net#

We now have HSTS, see here: https://www.ssllabs.com/ssltest/analyze.html?d=r4p3.net&hideResults=on

Noice

 

[dedmen]

https://hstspreload.org/?domain=r4p3.net still not green tho

 

[Kieran]

https://hstspreload.org/?domain=r4p3.net still not green tho

Preload is something different and not set up.
HSTS is enabled though.

 

[Asphyxia]

I think for preload every sub domain needs https, we could do that easily with certbot I guess

 

[Kieran]

I think for preload every sub domain needs https, we could do that easily with certbot I guess

Wildcards for letsencrypt in january. Wont be a problem then

 

[Asphyxia]

Wildcards for letsencrypt in january. Wont be a problem then

That will be very nice, I look forward to it!

 

[Kieran]

That will be very nice, I look forward to it!

Yesss we all do! It will reduce my entries in my cert to 5 instead of 25 xD
Got many subdomains and I'm waiting for this feature for such a long time.

Preload sounds good. Never knowingly visited a site with preload before

 

[Asphyxia]

Yesss we all do! It will reduce my entries in my cert to 5 instead of 25 xD
Got many subdomains and I'm waiting for this feature for such a long time.

Preload sounds good. Never knowingly visited a site with preload before

Same cert requirements make it hard