Security researcher Moxie Marlinspike introduced SSL stripping at Black Hat in 2009, along with a tool called sslstrip that automated it. The attack was uncomfortable precisely because the encryption was never broken. TLS did its job perfectly. The problem was that the browser was talked out of using it.
The gap the attack lives in
Think about how you actually reach a secure site. You type example.com into the address bar, not https://example.com. Your browser makes a first request over plain HTTP. The server then replies with a redirect telling the browser to come back over HTTPS. Only after that redirect does the encrypted connection begin.
That very first HTTP request, and the redirect that answers it, are the vulnerable moment. They happen before any encryption exists, which means an attacker in the network path can see and change them. SSL stripping targets exactly this handoff.
How the strip works, step by step
For the attack to run, the attacker must be in a position to intercept traffic. That usually means controlling the local network: a rogue Wi-Fi access point, a compromised router, or an ARP spoofing attack on a shared network. From there:
- You request the site over HTTP. The attacker intercepts it instead of letting it reach the server.
- The attacker opens its own HTTPS connection to the real server, pretending to be you. To the server, everything looks normal and encrypted.
- The server sends back pages, including the redirect to HTTPS and any links pointing at HTTPS URLs.
- The attacker rewrites all of it to HTTP before passing it to you, stripping the redirect and downgrading the links.
- You continue browsing over plain HTTP with the attacker, who relays everything to the server over HTTPS and reads it all in the clear on your side.
The page looked and worked exactly as expected. Your login form submitted, your session worked, your bank balance loaded. The only visible difference was the absence of the padlock, and in 2009 most people did not check for it. Passwords, session cookies, and form data all flowed through the attacker in plaintext.
Enter HSTS
The defense is HTTP Strict Transport Security, or HSTS, standardized in 2012 as RFC 6797. A site sends a response header, Strict-Transport-Security, that instructs the browser: for the next N seconds, never talk to this domain over plain HTTP, no matter what. Once a browser has seen that header, it upgrades every request to the site to HTTPS internally, before anything goes on the wire, and it refuses to fall back to HTTP even if the user clicks through a warning.
That closes the strip. There is no plaintext first request for the attacker to hijack, because the browser will not make one. If the attacker tries to force HTTP, the browser simply declines to connect.
The first-visit hole, and the preload fix
HSTS has one structural weakness: the browser only knows a site requires HTTPS after it has received the header at least once. The very first time you ever visit a site, or the first time on a fresh browser, there is no stored policy yet. An attacker who catches that first visit can still strip it. This is a trust-on-first-use gap, the same class of problem covered in our piece on TOFU key verification.
The answer is the HSTS preload list. Sites can submit themselves to a list that is compiled directly into Chrome, Firefox, Safari, and other browsers. A preloaded domain is treated as HSTS-protected from the very first request, with no vulnerable first visit at all. Our HSTS preload list explainer goes into how a domain gets on it and what committing to it means, since preloading is close to irreversible.
| Defense layer | What it stops |
|---|---|
| HTTPS redirect only | Nothing against a stripper. The redirect itself is what gets removed. |
| HSTS header | All strips after the browser has visited once and cached the policy. |
| HSTS preload list | Strips on the first visit too, because the policy ships inside the browser. |
| Browser HTTPS-only mode | Downgrades to any site by upgrading all requests and warning on plain HTTP. |
Where things stand now
The combination of near-universal HTTPS, widespread HSTS, the growing preload list, and browsers that now default to trying HTTPS first has made classic SSL stripping far less effective than it was. Modern browsers include an HTTPS-only or HTTPS-first mode that upgrades requests and shows a full-page warning before loading anything over plain HTTP, which addresses the first-visit gap even for sites that are not preloaded.
The attack is not entirely gone. It still finds room in a few places: older or embedded devices with outdated browsers, custom applications that do not enforce HTTPS, internal sites that were never given HSTS, and users who are trained to click past security warnings. And SSL stripping remains a component in broader interception setups, the same family of network position exploited by adversary-in-the-middle phishing kits and by hostile networks described in our public Wi-Fi security guide.
What to actually do
- Turn on HTTPS-only mode in your browser. It is a setting in Chrome, Firefox, Safari, and Edge, and it turns a silent downgrade into a visible warning.
- Do not click past certificate or HTTP warnings without understanding them. The warning is often the only signal that a strip or interception is happening.
- Treat untrusted networks as hostile. The attack needs a network position, so hotel, airport, and cafe Wi-Fi are where it lives.
- For site operators, deploy HSTS and consider preloading a domain you are confident will stay HTTPS-only, understanding that preload removal is slow.
Where Haven fits
SSL stripping is a reminder that a security layer only protects you if it cannot be skipped, and the fix was to make the secure path the only path a browser will take. Haven applies the same reasoning to communication. Message and email encryption is performed on the device and is not an optional upgrade that a network can negotiate away, using PGP for email and the MLS protocol for group chat. There is no plaintext mode for an attacker to force you down into, because content is encrypted before it ever reaches the transport. The secure path is the only path.