What is the purpose of the HSTS (HTTP Strict Transport Security) preload list on mobile browsers, and what attack does it prevent?
- A.A) The HSTS preload list is a hardcoded list of domains (included in browsers like Chrome and Safari) that must always be contacted over HTTPS; it prevents SSL stripping attacks by ensuring the first-ever connection to a preloaded domain uses HTTPS without a prior plaintext HTTP request that could be intercepted.
- B.B) HSTS preload is only relevant for desktop browsers; iOS Safari and Android Chrome do not implement HSTS preloading for mobile users.
- C.C) HSTS preload requires a server-side certificate renewal every 30 days; failure to renew removes the domain from the list and leaves it vulnerable.
- D.D) HSTS preload prevents HTTPS downgrade only for connections made over cellular; Wi-Fi connections to preloaded domains can still be SSL-stripped.
Why A is correct