Standing up sites that are HTTPS only are a matter of not opening port 80 on your server. HSTS is an action to force access to fail even when you know the content being served, know the server is correct, and understand the issues with certificates.

HSTS would be an annoyance, but still manageable if not for the complete removal of our user agency. I think that's really where HSTS moves from a security specification to an abhorrent abuse of monopoly control of web standards. It's less about protecting the user and more about giving Google and such power over what you can and can't view with your browser.

No, it's plainly not as simple as "not opening port 80", because an attacker can spoof the server side of port 80. This attack, "SSL stripping", is literally the reason we have HSTS.

I think you are missing my core point: That the web browser, as my agent, should do what I tell it. Which means any browser that refuses to load a site because of a cert issue because of HSTS, that browser has been hijacked by the server operator.

For any other certificate issue, my browser will allow me to bypass it if I know what I am doing. But because HSTS has hijacked the browser, it will no longer act in my stead unless I fork the browser and recompile it. I consider HSTS to be a malicious specification in this respect.

Your web browser should do what you tell it to, but it doesn't follow that people who provide apps are obligated to allow you to speak HTTP to them. I don't know what a "malicious specification" is, but your logic about how to lock apps into HTTPS (by simply not listening on 80/tcp) doesn't hold, at all.

That's not the request being made. What people want is for the button that says "this expired cert is fine, whatever" to still be available for hsts https sites.

I guess I don't understand what that has to do with HSTS, which was not designed for that button.

Basically, on any ordinary HTTPS site, every browser can allow you to proceed despite a certificate error. Such as knowing the certificate is expired or revoked or not from a known CA or something.

HSTS by specification prohibits browsers from offering that option. So I can know a server is serving valid, authentic traffic via HTTPS, be aware of why the certificate has an issue, and HSTS requires that my browser prohibit me from connecting to the server.

When an HSTS locked site has an expired cert, the browser takes away the "it's okay" button.

No, I get that. I get how you can reasonably argue about that feature. I don't get how you can argue that feature suggests we shouldn't stop SSL stripping at all.

HTTPS-only is fine, and I like it overall. But HSTS also cranks up certificate enforcement in a way that is sometimes excessive.