5 ms·
One thing that shocks me about this is the browser responses. Opera would not allow me to visit the sites affected, citing a revoked cert and possible attack. W
by liquidise 10y ago
One thing that shocks me about this is the browser responses. Opera would not allow me to visit the sites affected, citing a revoked cert and possible attack. While I appreciate the warning, it was odd to see the site fully disabled.
Safari on the other hand silently failed the https auth and served the page regardless. Concerning behavior for a revoked cert.
- wichert 10y agoThat might depend on the specific Safari version. I am using Safari 10 on macOS Sierra, and it would not allow me to access any site using one of the affected certs: instead it would just serve an error page.
- pilsetnieks 10y agoI think that was more because of the site, not the certificate - the grey failure page would appear for sites that use HSTS[0]. If the site didn't use HSTS or if you visited it for the first time, you'd get an ordinary certificate error alert. [0] https://en.wikipedia.org/wiki/HSTS https://en.wikipedia.org/wiki/HSTS
- gnopgnip 10y agoThe cert wasn't revoked though, just the cross signed intermediate.
- mst 10y agoPossibly your Safari had already cached an 'ok' result for the intermediate?
- duaneb 10y agoThe os already has an ocsp cache.
- robryk 10y agoIt baffles me why do all browsers pretend that https with an untrusted certificate is worse than plain http.
- doomtop 10y agoI think because with plain http there should be no illusion of security.
- robryk 10y agoDo you mean "we expect people not to have an illusion of security" or "we would want people not to have an illusion of security"? I posit that this actually creates an illusion that http is better than "insecure" https.