Chrome 68 will mark all HTTP sites as “not secure”

Re:Chrome 68 will mark all HTTP sites as “not secure” by ancarda on Thursday February 08, 2018 @02:50PM (#16335032)

If browsers allowed you to bypass HSTS, then it could be easily defeated by an attacker by breaking the traffic on port 443, forcing the user to disable SSL for the site. What would be the point over regular SSL? HSTS was designed as a response to programs like sslstrip, where the implementation of SSL may be attacked so the user is made vulnerable.

If a website puts out an HSTS header, they are telling the browser they need a higher bar of security than regular SSL.

[ Parent | on HN ]

Re:Chrome 68 will mark all HTTP sites as “not secure” by vageli on Thursday February 08, 2018 @07:26PM (#16336858)

And if I am a user of that website and am willing to accept the risks, why does Google force me to live with their opinion? HSTS should be bypassable with user consent.

[ Parent | on HN ]

Re:Chrome 68 will mark all HTTP sites as “not secure” by cpeterso on Thursday February 08, 2018 @07:30PM (#16336877)

Technically, HSTS is the website's opinion that you should not accept the risk, not Google's.

[ Parent | on HN ]

Re:Chrome 68 will mark all HTTP sites as “not secure” by vageli on Thursday February 15, 2018 @05:46PM (#16388470)

I get the distinction, but it's the browser that enforces the website's opinion, and I'm arguing that the browser should give the user absolute control for those users that want it.

[ Parent | on HN ]

Re:Chrome 68 will mark all HTTP sites as “not secure” by dylz on Thursday February 08, 2018 @07:40PM (#16336927)

Firefox: test.currentTimeOffsetSeconds

Chrome: type badidea

[ Parent | on HN ]