News for hackers. Stuff that matters.

A comment on Comcast Shot Themselves in the Foot with MTA-STS. Parent comment

Re:Comcast Shot Themselves in the Foot with MTA-STS by tedunangst on Wednesday January 19, 2022 @10:01PM (#30003928)
That's not the request being made. What people want is for the button that says "this expired cert is fine, whatever" to still be available for hsts https sites.
[ Parent | on HN ]
Re:Comcast Shot Themselves in the Foot with MTA-STS by tptacek on Wednesday January 19, 2022 @11:28PM (#30004636)
I guess I don't understand what that has to do with HSTS, which was not designed for that button.
[ Parent | on HN ]
Re:Comcast Shot Themselves in the Foot with MTA-STS by ocdtrekkie on Thursday January 20, 2022 @12:02AM (#30004882)
Basically, on any ordinary HTTPS site, every browser can allow you to proceed despite a certificate error. Such as knowing the certificate is expired or revoked or not from a known CA or something.

HSTS by specification prohibits browsers from offering that option. So I can know a server is serving valid, authentic traffic via HTTPS, be aware of why the certificate has an issue, and HSTS requires that my browser prohibit me from connecting to the server.

[ Parent | on HN ]
Re:Comcast Shot Themselves in the Foot with MTA-STS by tedunangst on Wednesday January 19, 2022 @11:50PM (#30004810)
When an HSTS locked site has an expired cert, the browser takes away the "it's okay" button.
[ Parent | on HN ]
Re:Comcast Shot Themselves in the Foot with MTA-STS by tptacek on Thursday January 20, 2022 @01:11AM (#30005384)
No, I get that. I get how you can reasonably argue about that feature. I don't get how you can argue that feature suggests we shouldn't stop SSL stripping at all.
[ Parent | on HN ]