News for hackers. Stuff that matters.

A comment on Hijack of Amazon’s domain service used to reroute web traffic for two hours. Parent comment

Re:Hijack of Amazon’s domain service used to reroute web tra... by an_account_name on Tuesday April 24, 2018 @03:22PM (#16915721)
HSTS does indeed prevent users from clicking through the warning - it makes handshake / trust chain failure fatal with no "proceed anyway" button.
[ Parent | on HN ]
Re:Hijack of Amazon’s domain service used to reroute web tra... by triplenineteen on Tuesday April 24, 2018 @03:56PM (#16916001)
Sorta. In most browsers you can manually delete the HSTS property on a per-domain basis. Presumably, anyone doing this knows the risks.
[ Parent | on HN ]
Re:Hijack of Amazon’s domain service used to reroute web tra... by caymanjim on Tuesday April 24, 2018 @04:19PM (#16916165)
In Chrome, it's a real pain in the ass, and it's buried deeply. It's not available at all in the settings UI (not even in advanced settings).
[ Parent | on HN ]
Re:Hijack of Amazon’s domain service used to reroute web tra... by ascorbic on Tuesday April 24, 2018 @04:45PM (#16916403)
You can type "badidea" at the warning page to skip it.
[ Parent | on HN ]
Re:Hijack of Amazon’s domain service used to reroute web tra... by rocqua on Tuesday April 24, 2018 @05:39PM (#16916870)
Changed to "This is unsafe" (followed by enter) in chrome 65. Try it at https://badssl.finn.io/
[ Parent | on HN ]
Re:Hijack of Amazon’s domain service used to reroute web tra... by Moter8 on Tuesday April 24, 2018 @04:53PM (#16916463)
Doesn't work for me (anymore) in Chrome 65. Used to work.
[ Parent | on HN ]
Re:Hijack of Amazon’s domain service used to reroute web tra... by CydeWeys on Tuesday April 24, 2018 @05:12PM (#16916649)
I think it was changed to something like "thisisunsafe" now.
[ Parent | on HN ]
Re:Hijack of Amazon’s domain service used to reroute web tra... by rocqua on Tuesday April 24, 2018 @05:39PM (#16916867)
Just checked this on chrome 65 on https://badssl.finn.io/ seems to work (also need to press enter).
[ Parent | on HN ]
Re:Hijack of Amazon’s domain service used to reroute web tra... by verbify on Tuesday April 24, 2018 @05:48PM (#16916954)
That's correct, tested it with https://badssl.finn.io/
[ Parent | on HN ]
Re:Hijack of Amazon’s domain service used to reroute web tra... by ZeroCool2u on Tuesday April 24, 2018 @04:52PM (#16916455)
Had no idea about that 'badidea' work around in chrome. Just tried it and it actually worked.
[ Parent | on HN ]
Re:Hijack of Amazon’s domain service used to reroute web tra... by hkdobrev on Tuesday April 24, 2018 @04:52PM (#16916449)
In Chrome, clearing the cache, clears the saved HSTS records which are not preloaded in the browser.
[ Parent | on HN ]