4 ms·

I really, really disagree. If your data is on my computer I should have a say in what happens to it. If I want to tunnel your hsts connection through a proxy I

by SCHiM 11y ago

I really, really disagree. If your data is on my computer I should have a say in what happens to it. If I want to tunnel your hsts connection through a proxy I should be able to do so. You can't imagine how frustrated I was when I found out that I couldn't use my proxy any more, because some guy somewhere decided that it'd bee too hard to hard to add the following lines to firefox: if (user_doesn't_want_hsts) { dont_do_hsts(); } I can't even bend my head around how someone thought it was acceptable to totally take this option away from people. I understand that such an option should be hidden deep inside a config somewhere so as to prevent a normal user from compromising his/her own security. But please don't presume that you did everyone a service by taking this option away. I can't express how angry and frustrated I become when I even think about it. As for your 'no downside', as I said, perhaps not for normal users. But I most definitively am not. And I probably need to jump though a lot of hoops to tear this "feature" out of my own firefox build.

acdha 11y ago
> I really, really disagree. If your data is on my computer I should have a say in what happens to it. If I want to tunnel your hsts connection through a proxy I should be able to do so. You need to read more about how HSTS actually works: https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security It does nothing that a site could not do by having their webserver redirect all HTTP requests to HTTPS with the exception that it prevents the browser to never make an insecure request to prevent a man-in-the-middle attacker from tampering with it. Of particular interest, note that it does not prevent you from using a proxy if you choose to configure one. The only thing it prevents is a transparent proxy intercepting all traffic on the network, which is a class of MITM attack, and a frequent source of security or privacy issues. If you need to use a tampering SSL proxy you would, of course, need to configure it to generate certificates using a CA which you trust, which is a well-documented feature and something which has already been a requirement for many, many years. > As for your 'no downside', as I said, perhaps not for normal users. But I most definitively am not. And I probably need to jump though a lot of hoops to tear this "feature" out of my own firefox build. Or learn how to configure your proxy so that it works with the security mechanism rather than unnecessarily exposing you to attacks. Your argument is a perfect example of why this is a good move: most people will simply hit whatever button causes the page to load without thinking through the security implications.
nightpool 11y ago
You... really don't understand HSTS or how proxies work. Any actual secure proxy configuration would still work just fine with HSTS. Its only ones that specifically downgrade HTTPS connections to HTTP ones that break.

by SCHiM 11y ago

acdha 11y ago

> I really, really disagree. If your data is on my computer I should have a say in what happens to it. If I want to tunnel your hsts connection through a proxy I should be able to do so. You need to read more about how HSTS actually works: https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security It does nothing that a site could not do by having their webserver redirect all HTTP requests to HTTPS with the exception that it prevents the browser to never make an insecure request to prevent a man-in-the-middle attacker from tampering with it. Of particular interest, note that it does not prevent you from using a proxy if you choose to configure one. The only thing it prevents is a transparent proxy intercepting all traffic on the network, which is a class of MITM attack, and a frequent source of security or privacy issues. If you need to use a tampering SSL proxy you would, of course, need to configure it to generate certificates using a CA which you trust, which is a well-documented feature and something which has already been a requirement for many, many years. > As for your 'no downside', as I said, perhaps not for normal users. But I most definitively am not. And I probably need to jump though a lot of hoops to tear this "feature" out of my own firefox build. Or learn how to configure your proxy so that it works with the security mechanism rather than unnecessarily exposing you to attacks. Your argument is a perfect example of why this is a good move: most people will simply hit whatever button causes the page to load without thinking through the security implications.

nightpool 11y ago

You... really don't understand HSTS or how proxies work. Any actual secure proxy configuration would still work just fine with HSTS. Its only ones that specifically downgrade HTTPS connections to HTTP ones that break.