title: Is it possible to establish a secure connection with a user, even by redirecting to HTTPS?
body: <p>So this is a somewhat broad question, I know, but I'm hoping someone who is wiser than I can provide a summary answer that can help wrap up all of the ins and outs of SSL for me.</p>
  
  <p>Recently I watched a video of Moxie Marlinspike giving a presentation at BlackHat, and after the hour was up, I thought to myself, "It doesn't really matter what I do. There's always a way in for a determined hacker."  I recall his final example, in which he demonstrated how even using a redirect when the user typed in an HTTP address to go directly to HTTPS, there is still an opportunity in that transition for an attacker to insert himself via MITM.</p>
  
  <p>So if browsers always default to HTTP, and users very rarely enter an HTTPS address directly in the address bar, then an attacker who is listening for accesses to Bank X's website will always have an opportunity during the HTTP -> HTTPS redirect to gain control.  I think they have to be on the same network, but that's little consolation.  Seems like Marlinspike's point was that until we go straight HTTPS as a standard rather than an alternative, this will always be a problem.</p>
  
  <p>Am I understanding this correctly?  What is the point in redirecting to HTTPS if an attacker can use MITM during the transition to gain control?  Does anyone have any clue as to preventative measures one might take to protect himself?  Would redirecting via javascript that obfuscates the HTTPS links (so they can't be stripped out in transit) be of any help?  Any thoughts would be appreciated!</p>