4 ms·

To be completely honest, this kind of counter-argument (not that you are advocating against HTTPS, but bear with we) always reads to me like "people forget pass

To be completely honest, this kind of counter-argument (not that you are advocating against HTTPS, but bear with we) always reads to me like "people forget passwords, and don't like having to type usernames, so we just rely on the honor system". Yes, security has downsides, but in my opinion those downsides are well worth it for the benefits.

AnIdiotOnTheNet 9y ago
That very much depends on the circumstances doesn't it?
badsectoracula 9y ago
Personally i wouldn't mind it that much if the browser let me bypass the error but HSTS seems to mean "even if the site would work fine otherwise, keep it broken". There have been several cases where i couldn't bypass such an error in a site that i just wanted to read something and i was very surprised to see that Firefox didn't had any about:config option to indicate that "i know what i am doing, let me in". So much for taking back the web. Seems it was only temporary so we can hand it to Google.
- ancarda 9y ago
  If browsers allowed you to bypass HSTS, then it could be easily defeated by an attacker by breaking the traffic on port 443, forcing the user to disable SSL for the site. What would be the point over regular SSL? HSTS was designed as a response to programs like sslstrip, where the implementation of SSL may be attacked so the user is made vulnerable. If a website puts out an HSTS header, they are telling the browser they need a higher bar of security than regular SSL.
  - vageli 9y ago
    And if I am a user of that website and am willing to accept the risks, why does Google force me to live with their opinion? HSTS should be bypassable with user consent.
    - cpeterso 9y ago
      Technically, HSTS is the website's opinion that you should not accept the risk, not Google's.
      - vageli 9y ago
        I get the distinction, but it's the browser that enforces the website's opinion, and I'm arguing that the browser should give the user absolute control for those users that want it.
    - dylz 9y ago
      Firefox: test.currentTimeOffsetSeconds Chrome: type badidea

AnIdiotOnTheNet 9y ago

That very much depends on the circumstances doesn't it?

badsectoracula 9y ago

Personally i wouldn't mind it that much if the browser let me bypass the error but HSTS seems to mean "even if the site would work fine otherwise, keep it broken". There have been several cases where i couldn't bypass such an error in a site that i just wanted to read something and i was very surprised to see that Firefox didn't had any about:config option to indicate that "i know what i am doing, let me in". So much for taking back the web. Seems it was only temporary so we can hand it to Google.

ancarda 9y ago
If browsers allowed you to bypass HSTS, then it could be easily defeated by an attacker by breaking the traffic on port 443, forcing the user to disable SSL for the site. What would be the point over regular SSL? HSTS was designed as a response to programs like sslstrip, where the implementation of SSL may be attacked so the user is made vulnerable. If a website puts out an HSTS header, they are telling the browser they need a higher bar of security than regular SSL.
- vageli 9y ago
  And if I am a user of that website and am willing to accept the risks, why does Google force me to live with their opinion? HSTS should be bypassable with user consent.
  - cpeterso 9y ago
    Technically, HSTS is the website's opinion that you should not accept the risk, not Google's.
    - vageli 9y ago
      I get the distinction, but it's the browser that enforces the website's opinion, and I'm arguing that the browser should give the user absolute control for those users that want it.
  - dylz 9y ago
    Firefox: test.currentTimeOffsetSeconds Chrome: type badidea