Search papers, labs, and topics across Lattice.
This paper introduces HSTS-Enforced, a novel mechanism that flips the current opt-in security model for HTTPS to an opt-out model, defaulting all connections to HTTPS and allowing operators to explicitly opt-out to HTTP via HTTP-Required indicators. The proposed solution uses either a new DNS record or an HTTP-Required Preload list to signal the need for HTTP, effectively eliminating the attack surface for TLS stripping attacks. Evaluation demonstrates that HSTS-Enforced blocks all practical TLS stripping attempts while maintaining compatibility for sites that require HTTP, without introducing overhead in the typical case.
Say goodbye to TLS stripping attacks: HSTS-Enforced flips the web's security model, making HTTPS the default and eliminating the need for complex opt-in configurations.
TLS stripping attacks expose sensitive web traffic by forcing secure HTTPS connections to fall back to unencrypted HTTP. At present, protection against these attacks relies on website operators explicitly opting into security by deploying mechanisms such as HTTP Strict Transport Security (HSTS) headers. These mechanisms have significant limitations: some are weak or difficult to configure, which raises the risk of misconfiguration and reduces practical adoption; others violate HTTP backward compatibility; at least one can even be abused to enable unintended user tracking. We introduce HSTS-Enforced, a mechanism that eliminates the remaining attack surface for TLS stripping while still allowing operators to securely specify that their websites need to be accessed over HTTP when necessary, thereby maintaining accessibility. To achieve this, we flip the current opt-in security model to an opt-out model: all connections default to HTTPS, and operators can explicitly opt out if their websites require HTTP using so-called HTTP-Required indicators. We propose two such HTTP-Required indicators: a new DNS record and an HTTP-Required Preload list. We evaluate HSTS-Enforced under multiple deployment scenarios, demonstrating that it blocks all practical TLS stripping attempts while maintaining compatibility for sites that require HTTP - without introducing overhead in the typical case. Finally, we outline a practical transition path to accelerate global adoption.
