4 ms·
As long as you visited Gmail within the last 126 days, your browser won't allow you to visit the HTTP version of Gmail because they have HSTS[1] enabled: > str
by welder 10y ago
As long as you visited Gmail within the last 126 days, your browser won't allow you to visit the HTTP version of Gmail because they have HSTS[1] enabled:
> strict-transport-security:max-age=10886400; includeSubdomains
This sensational article fails to mention that.
To protect your website visitors, enable the HSTS header on your web server. Basically just use SSL Labs[2] and fix everything until you have an A+ rating.
[1] https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security
[2] https://www.ssllabs.com/ssltest/analyze.html?d=wakatime.com https://www.ssllabs.com/ssltest/analyze.html?d=wakatime.com
- michaelmior 10y agoThe article does mention HSTS. And for many sites on several browsers you don't have to have previously visited them because the HSTS list is preloaded.
- tombrossman 10y agoMore info here, also you can submit your own site: https://hstspreload.appspot.com/ https://hstspreload.appspot.com/ I did this a while back for several of my domains and it was easy and fast. One new problem I have is that after getting on the list and moving the static HTML sites over to CloudFront's free HTTPS offering, I see Chrome 50+ will require that you keep sending the 'preload' header directive, which is impossible to do with CloudFront. Bummer. If anyone from AWS sees this, please note this is one more reason your users want the ability to send extra headers. Even if it's only a select few headers chosen from a dropdown list, this added functionality would come as very welcome news.
- mioelnir 10y agoMy personal grief with HSTS is that it pretty much requires you to have installed and trusted one random 400 CA collection or the other. If you have uninstalled/distrusted most of them, no current browser will allow you to access a HSTS enabled domain using one of those distrusted CAs. There is no override to skip and accept an encryption-only connection. Which is what I would have gotten with HSTS as well, because without independent verification the CA system is a lot, but not the mutually trusted third party it claims to be.
- pfg 10y agoI'm quite happy that there's no way to bypass the intersitial for HSTS sites. Preventing non-technical users from clicking through SSL warnings (which is very common) is definitely more important than supporting a use-case that only affects a very, very small subset of users. If there's enough demand, I'm sure someone's going to introduce a hidden flag or some kind of extension that allows you to do this.
- mioelnir 10y agoI understand why it is done; and that the new error pages that are not filled with technical details are a net win overall. But there are people out there that need those technical details, so that other people do not have to see them.
- ryan-c 10y agoChrome at least, does allow HSTS errors to by overridden (and "safe browsing" warnings). It's just not exposed visibly. There is a deliberately undocumented "cheat code" that you need to type.
- wingless 10y agoYou don't even need Gmail in your HSTS set if you have HTTPS Everywhere installed in your browser.