Google Tightens Web Security for 45 TLDs with HSTSGoogle Tightens Web Security for 45 TLDs with HSTS
Google broadens HTTPS Strict Transport Security to Top Level Domains under its control and makes them secure by default.
October 2, 2017
Google is buckling down on Web security by extending HTTP Strict Transport Security (HSTS) to Top Level Domains (TLDs) under its control, the company reports.
HTTPS prevents traffic from being intercepted or misdirected in transit. HSTS automatically enforces HTTPS for connections between clients and Web servers. If someone types http://gmail.com, the browser changes it to https://gmail.com before sending the request.
In doing so, it makes connections more secure and prevents threats like downgrade attacks and cookie hijacking. Google has a HSTS preload list, which is built into all major browsers and contains a list of individual domains, subdomains, and TLDs for which browsers automatically enforce HTTPS connections. It operates 45 TLDs including .google, .how, and .soy.
Back in 2015, Google created the first secure TLD by adding .google to the HSTS preload list. Now it's extending HSTS to more of its TLDs, starting with .foo and .dev, making these websites secure by default without additional work for their users.
"Registrants receive guaranteed protection for themselves and their users simply by choosing a secure TLD for their website and configuring an SSL certificate, without having to add individual domains or subdomains to the HSTS preload list," explained Google Registry's Ban McIlwain in a blog post on the news.
This move will also accelerate the security update process. Normally, there are a few months between the time a domain name is added to the list, and the time browser upgrades reach most users. Using a secure TLD means users are immediately protected.
Read more details here.
About the Author(s)
You May Also Like
Hacking Your Digital Identity: How Cybercriminals Can and Will Get Around Your Authentication MethodsOct 26, 2023
Modern Supply Chain Security: Integrated, Interconnected, and Context-DrivenNov 06, 2023
How to Combat the Latest Cloud Security ThreatsNov 06, 2023
Reducing Cyber Risk in Enterprise Email Systems: It's Not Just Spam and PhishingNov 01, 2023
SecOps & DevSecOps in the CloudNov 06, 2023
9 Traits You Need to Succeed as a Cybersecurity Leader
The Ultimate Guide to the CISSP
Modernize your Security Operations with Human-Machine Intelligence
The Evolving Ransomware Threat: What Business Leaders Should Know About Data Leakage
Building Immunity: The 2021 Healthcare and Pharmaceutical Industry Cyber Threat Landscape Report