1

For systems that only connect to the internet via a single dedicated private network (no WiFi hotspots), and assuming no systems or components on that network are compromised, does HSTS (HTTP Strict Transport Security) provide any security advantages?

2
  • Where does the target website reside? On the private network or external? Dec 13 '19 at 9:41
  • @user2320464 Good question. External network. Dec 13 '19 at 21:04
5

and assuming no systems or components on that network are compromised

...and assuming that nobody who has access to the systems or the networks has any bad intentions and can be trusted with visibility of any data passing through the network....then no, it adds nothing.

But those are very big assumptions.

2
  • When you mention "networks" in the answer, are you referring to the system's local network, or the network beyond the internet connection? Dec 12 '19 at 21:30
  • anywhere between the server and the users.
    – symcbean
    Dec 12 '19 at 22:41
1

Essentially if you assume "no systems or components on that network are compromised" your in very deep water already. What if they get compromised?

At the end of the day it comes down to your organization evaluating risk and the benefits of implementing the ways to mitigate the risk.

0

You get all of the benefits of an encrypted connection!

  • Assurance knowing you're connected directly to the target website via certificate validation. This protects against: Man-in-the-middle attacks, DNS hijacking, BGP hijacking, Domain spoofing (Why is HTTP not secure?).
  • The target website is more secure since all content is loaded over HTTPS. Some examples include protecting against posting from http to https and mixed-content while securing logins and cookies.
  • Some ISPs have been known to monitor connections for ad serving purposes which encryption defeats.
  • You're protected should an adjacent system become compromised.

The following is a closely related post from this site.

What vulnerabilities are there for a website that does not use SSL for a login page (or any pages)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.