HTTPS is subject to several MITM attacks, that is clear. However I think it would be helpful to the ITSec crowd if there was a way to force a certain browser behaviour when accessing known-trusted sites.
Based on my (average) knowledge of MITM vectors, it would be beneficial to secure specific domains with client/browser behavior that forced any of the following settings :
Only use HTTPS when connecting domain X
If-Modified-Sinceheader. Ideally, I want cached content to never expire, regardless of what the "server" says.
Require SSL Only Cookies. I am looking for a way for the browser to require SSL Only cookies by DNS domain name, and possibly by cookie name.
Ignore 30x redirects.
Ultimately, I would like to take the recommendations and format them into a security guide for the end user, or actually deploy them internally to all internal clients, when connecting to a secured list of websites.