How Tallyfy uses HTTP Strict Transport Security (HSTS)

HTTP Strict Transport Security (HSTS) is a web security standard that Tallyfy employs to protect your data and ensure secure communication between your browser and our platform. This article explains what HSTS is, how it benefits you as a Tallyfy user, and the security threats it helps prevent.

What is HTTP Strict Transport Security (HSTS)?

HSTS is a security policy mechanism that web servers use to declare that browsers (or other compliant user agents) should only interact with them using secure HTTPS connections. It effectively tells your browser: “Only talk to me over a secure, encrypted channel.”

When you connect to Tallyfy for the first time over HTTPS, our servers send a special response header called Strict-Transport-Security. This header instructs your browser to exclusively use HTTPS for all future connections to Tallyfy domains for a specific duration (defined by the max-age directive, typically set for a long period like two years).

How Tallyfy uses HSTS

Tallyfy fully implements HSTS across its services. Importantly, Tallyfy is also included in the HSTS preload lists used by major web browsers (like Chrome, Firefox, Safari, and Edge).

Being on the preload list means your browser knows to only use HTTPS for Tallyfy even before your first visit. This eliminates a small window of vulnerability present with standard HSTS implementation, providing enhanced security from the very start.

Benefits of HSTS for Tallyfy customers

Tallyfy’s use of HSTS provides several security and privacy benefits:

• Protection Against Man-in-the-Middle Attacks: A significant benefit is preventing SSL stripping attacks. In this attack, an adversary intercepts your initial HTTP request (if you accidentally typed http://tallyfy.com or clicked an old HTTP link) and forces your browser to communicate over unencrypted HTTP, even if the server supports HTTPS. HSTS prevents this by forcing the browser to upgrade to HTTPS before any communication occurs over the network.
• Cookie Security: Sensitive information stored in browser cookies (like session identifiers) can be intercepted if sent over an unencrypted HTTP connection. HSTS ensures that cookies marked as secure are never transmitted over HTTP, protecting your session from hijacking on insecure networks like public Wi-Fi.
• Privacy: By enforcing encryption for all communication, HSTS ensures that your interactions with Tallyfy remain confidential and resistant to eavesdropping.
• User Confidence: Knowing that Tallyfy employs established security standards like HSTS provides assurance that your data is handled securely.

Security threats prevented by HSTS

HSTS specifically addresses security vulnerabilities:

• SSL Stripping: As mentioned, HSTS is the primary defense against attackers downgrading your connection from secure HTTPS to insecure HTTP.
• Protocol Downgrade Attacks: More broadly, it prevents any attempt to force the use of the insecure HTTP protocol.
• Cookie Hijacking: By ensuring cookies are only sent over encrypted HTTPS, it thwarts attempts to steal session cookies on insecure networks.

Real-life example: Public Wi-Fi

Imagine you’re using Tallyfy on a public Wi-Fi network (e.g., at a coffee shop or airport). An attacker on the same network could attempt an SSL stripping attack. If you typed http://tallyfy.com, the attacker could intercept this and prevent your browser from upgrading to the secure HTTPS version, potentially capturing your login credentials or other sensitive data. Because Tallyfy uses HSTS (and is preloaded), your browser automatically upgrades the connection to HTTPS locally, thwarting the attacker before the request even leaves your device.

HSTS requirements and why they exist

For HSTS (and especially HSTS preloading) to work effectively and securely, web services must meet certain requirements:

1. Serve a Valid TLS/SSL Certificate: The foundation of HTTPS is a valid certificate from a trusted authority. This proves the server’s identity and enables encryption. Why? Ensures the encrypted connection is genuinely with Tallyfy and not an imposter.
2. Redirect HTTP to HTTPS: Any request made to the HTTP version of the site must be permanently redirected (using a 301 status code) to the HTTPS version. Why? Guides users and search engines to the secure version and is necessary for the HSTS header to be received over a secure connection.
3. Serve All Content Over HTTPS: The website, including all subdomains (if includeSubDomains is used) and all resources (images, scripts, stylesheets), must be accessible over HTTPS without errors. Why? Prevents mixed content warnings and ensures the entire user experience is secure.
4. Serve the HSTS Header over HTTPS: The Strict-Transport-Security header must be sent only on responses from HTTPS connections. Why? Headers sent over HTTP can be manipulated or stripped by attackers, so they are ignored by browsers.
5. Specify a Long max-age: The max-age directive must be set to a substantial duration (at least 31536000 seconds, or 1 year, is required for preloading). Why? Ensures browsers enforce HTTPS for an extended period, maintaining protection between visits.
6. Include the includeSubDomains Directive (for Preload): This directive must be present for preload list inclusion, ensuring the policy applies to all current and future subdomains. Why? Provides comprehensive protection across the entire domain.
7. Include the preload Directive (for Preload): This directive signals consent for the domain to be included in browser preload lists. Why? Necessary opt-in mechanism for the enhanced security of preloading.

These requirements ensure that once a browser learns the HSTS policy for Tallyfy, it can reliably and securely enforce HTTPS-only communication, providing protection against common web attacks.

Related articles

Miscellaneous > Terms & legals

Tallyfy maintains robust security standards with SOC 2 Type 2 attestation GDPR compliance encrypted data storage secure API handling and multiple enterprise-level security features including free SSO and optional AWS GovCloud hosting.

Tracking And Tasks > Protect sensitive data

Protecting sensitive data requires storing confidential information in secure systems with controlled access while using secure links to reference the data within task descriptions.

Pro > Compliance

Tallyfy employs comprehensive security measures including SOC 2 Type 2 compliance robust access controls data encryption system monitoring and vendor management to protect customer data and maintain platform reliability.

Terms Legals > Tallyfy's privacy policy

Detailed privacy policy and IT documentation information can be accessed through specific links on Tallyfy’s website alongside related resources about security measures and data protection practices.