No, not that kind of creepy security bug. It doesn't need to be restricted.

For WhatsApp: https://bit.ly/2Pev7qb

Could someone set up ftp://accounts.google.com/login.html as MitM in a Wifi?

(94.130.231.169 accounts.google.com in /etc/hosts)

Deleted: Screenshot_20181005_145155.png 544 KB

	Screenshot_20181005_145155.png 544 KB View Download

Filed https://bugs.chromium.org/p/chromium/issues/detail?id=892639 for comment 2.

Thanks for the report. HSTS works for HTTP only (hence the name) so there isn't a security vulnerability here. Removing view restriction and adjusting labels.

I think  crbug.com/744499  would be a good solution to the general problem here.

We signed up for HSTS Preloading because we would like to prevent web browsers to connect insecurely to our domains. I don't perceive a large difference between http and ftp. You even upgrade http://terrax.net:1337/ to https. (And why is comment 3 even locally possible?)

Solutions for domains that wish Strict Transport Security:
1. Introduce support for ftps:// and apply preloading rules there. Ehm, rather not?
2. Upgrade (at least consumers!) to https://.
   According to stats this might be a save change: https://bugzil.la/1438713#c1
   (Someone could still use another ftp client like FileZilla.)

 https://crbug.com/744499  would be cool for domains that don't care about enforcing encryption.

I don't think we should take any action here - ftp is tangential to HTTP, and shares none of the user state (Cookies, credentials, etc).  Eventually we hope to be able to remove FTP, anyways.

Actually, I guess if we still render HTML over ftp, the renderer may leak state between the two.

I don't fear technical problems, just bad security UX. Updated the demo page.
As one would expect from HSTS, ws:// is also upgraded to wss:// (since  https://crbug.com/455215 ).

This would affect all OSs; I don't know about iOS though, since https://bugs.chromium.org/p/chromium/issues/detail?id=892639 does not affect Safari.

If anyone could demonstrate that the origin (ftp, example.org, ...) could interact with the origin https, example.org, ...), we'd have a separate problem on our hands which this bug would exacerbate.