opliko@opliko.dev · 2y ago

Resulting in a nice, unskippable HSTS error for your victim when they go to pretty much any site that matters. Again: this is the exact scenario HSTS protects from. It's already widely deployed and there are even some entire TLDs that are preloaded.