.APP HSTS/SSL

[chris]

I didn't want to hijack another thread on .app, but one thing I do like about .app is that it's one of the few extensions that forces you to use SSL by being added to the "HSTS Preload" list. This means the namespace will be 100% SSL.

More reading:

https://hstspreload.org/

https://www.thesslstore.com/blog/google-launches-dot-app/

 

[snoopy]

Is there any strong reason for forcing SSL with it given nothing is likely to sold on the site itself with everything taking place on app stores?

I don’t think consumers would care and for developers it may just be a headache.

 

[chris]

Is there any strong reason for forcing SSL with it given nothing is likely to sold on the site itself with everything taking place on app stores?

I don’t think consumers would care and for developers it may just be a headache.

I know there are some barriers to going full HTTPS, but I think we're moving that way. Most browsers are starting to roll out features that flag all sites not using HTTPS as not secure.

 

[chris]

A quick update on this:

https://blog.chromium.org/2018/05/evolving-chromes-security-indicators.html

Since we’ll soon start marking all HTTP pages as “not secure”, we’ll step towards removing Chrome’s positive security indicators so that the default unmarked state is secure. Chrome will roll this out over time, starting by removing the “Secure” wording and HTTPS scheme in September 2018 (Chrome 69).