Re:Chrome 68 will mark all HTTP sites as “not secure”
by badsectoracula on Thursday February 08, 2018 @02:23PM
(#16334796)
Personally i wouldn't mind it that much if the browser let me bypass the error but HSTS seems to mean "even if the site would work fine otherwise, keep it broken". There have been several cases where i couldn't bypass such an error in a site that i just wanted to read something and i was very surprised to see that Firefox didn't had any about:config option to indicate that "i know what i am doing, let me in". So much for taking back the web. Seems it was only temporary so we can hand it to Google.
[ Parent
| on HN ]
Re:Chrome 68 will mark all HTTP sites as “not secure”
by ancarda on Thursday February 08, 2018 @02:50PM
(#16335032)
If browsers allowed you to bypass HSTS, then it could be easily defeated by an attacker by breaking the traffic on port 443, forcing the user to disable SSL for the site. What would be the point over regular SSL? HSTS was designed as a response to programs like sslstrip, where the implementation of SSL may be attacked so the user is made vulnerable.
If a website puts out an HSTS header, they are telling the browser they need a higher bar of security than regular SSL.
Re:Chrome 68 will mark all HTTP sites as “not secure”
by vageli on Thursday February 08, 2018 @07:26PM
(#16336858)
And if I am a user of that website and am willing to accept the risks, why does Google force me to live with their opinion? HSTS should be bypassable with user consent.
Re:Chrome 68 will mark all HTTP sites as “not secure”
by cpeterso on Thursday February 08, 2018 @07:30PM
(#16336877)
Technically, HSTS is the website's opinion that you should not accept the risk, not Google's.