4 ms·

HSTS does indeed prevent users from clicking through the warning - it makes handshake / trust chain failure fatal with no "proceed anyway" button.

• triplenineteen 8y ago
  Sorta. In most browsers you can manually delete the HSTS property on a per-domain basis. Presumably, anyone doing this knows the risks.
  • caymanjim 8y ago
    In Chrome, it's a real pain in the ass, and it's buried deeply. It's not available at all in the settings UI (not even in advanced settings).
    • ascorbic 8y ago
      You can type "badidea" at the warning page to skip it.
      • Moter8 8y ago
        Doesn't work for me (anymore) in Chrome 65. Used to work.
        • CydeWeys 8y ago
          I think it was changed to something like "thisisunsafe" now.
          • rocqua 8y ago
            Just checked this on chrome 65 on https://badssl.finn.io/ https://badssl.finn.io/ seems to work (also need to press enter).
          • verbify 8y ago
            That's correct, tested it with https://badssl.finn.io/ https://badssl.finn.io/
      • rocqua 8y ago
        Changed to "This is unsafe" (followed by enter) in chrome 65. Try it at https://badssl.finn.io/ https://badssl.finn.io/
    • hkdobrev 8y ago
      In Chrome, clearing the cache, clears the saved HSTS records which are not preloaded in the browser.
    • ZeroCool2u 8y ago
      Had no idea about that 'badidea' work around in chrome. Just tried it and it actually worked.