US .Gov Domains to Preload HSTS for Maximum Security

guest · Jun 23, 2020

US .Gov Domains to Preload HSTS for Maximum Security
June 23, 2020
https://www.infosecurity-magazine.com/news/us-gov-domains-preload-hsts/

US government websites are taking another major step forward to becoming more secure after it was announced that all .gov TLDs would be changed to enforce HSTS preloading.

The DotGov program made the announcement on Sunday, stating that all new .gov domains will be automatically preloaded from September 1 2020. The transitioning of historical ones will take longer.

“For a user to take advantage of HSTS, however, their browser has to see the HSTS header on a site at least once. This means that users are not protected until after their first successful secure connection to a given domain, which may not occur in certain cases,” wrote DotGov.
“To solve this problem, a domain can be submitted to the HSTS preload list, a list of domains embedded into browsers that get HSTS enabled automatically, even for the first visit. [...]
Click to expand...

Although new .gov TLDs will be preloaded automatically from September, existing ones will take much longer to transition. If preloading was switched on today, those that don’t currently offer HTTPS would become inaccessible to users, DotGov warned.

“Actually preloading is a simple step, but getting there will require concerted effort among the federal, state, local and tribal government organizations that use a common resource, but don’t often work together in this area,” it explained.
Click to expand...

DotGov: Making .gov More Secure by Default

When the public sees information on a .gov website, they need to trust that it is official and accurate. This trust is warranted, because registration of a .gov domain is limited to bona fide US-based government organizations. Governments should be easy to identify on the internet and users should be secure on .gov websites.
Click to expand...

Log in or Sign up

US .Gov Domains to Preload HSTS for Maximum Security

guest Guest

Log in or Sign up

US .Gov Domains to Preload HSTS for Maximum Security

guest Guest

Useful Searches