There seems to be widespread support for the idea that election-related websites, of all things, should be resistant to man-in-the-middle attacks. The secret ballot makes detecting and recovering from SSL-stripping more difficult than the average web use case.
Yet analysis of the Chrome preload list reveals that almost no election related websites present, with the exception of Swiss Post's online voting system. So I've been trying to encourage and promote HSTS preload adoption among election agencies and online voting vendors.
As people encounter HSTS preloading for the first time, one of the first questions seems to be: if it's so great, why isn't everyone using it? For better or worse, banks are regarded as a benchmark for web security and in particular I've been getting this question:
If HSTS preloading is so great, why aren't the banks using it?
Indeed if you check your own financial institution against the preload list you will likely find it absent:
There are several possibilities, though in my observation if a site is not on the preload list, the site owner typically either:
- Doesn't know about the preload list, or
- Adding their site might break something in their web infrastructure.
With the banks, the best I can think of is that they rely heavily on an internal, unencrypted intranet that would be denial-of-serviced if they added themselves to the list. But that's just speculation, and I would be grateful to anyone with knowledge of their rationale.