5 ms·
If browsers allowed you to bypass HSTS, then it could be easily defeated by an attacker by breaking the traffic on port 443, forcing the user to disable SSL for
by ancarda 9y ago
If browsers allowed you to bypass HSTS, then it could be easily defeated by an attacker by breaking the traffic on port 443, forcing the user to disable SSL for the site. What would be the point over regular SSL? HSTS was designed as a response to programs like sslstrip, where the implementation of SSL may be attacked so the user is made vulnerable.
If a website puts out an HSTS header, they are telling the browser they need a higher bar of security than regular SSL.
- vageli 9y agoAnd if I am a user of that website and am willing to accept the risks, why does Google force me to live with their opinion? HSTS should be bypassable with user consent.
- cpeterso 9y agoTechnically, HSTS is the website's opinion that you should not accept the risk, not Google's.
- vageli 9y agoI get the distinction, but it's the browser that enforces the website's opinion, and I'm arguing that the browser should give the user absolute control for those users that want it.
- dylz 9y agoFirefox: test.currentTimeOffsetSeconds Chrome: type badidea