5 ms·

I still very strongly oppose HSTS's "No user recourse" policy, and don't deploy it on my sites purely for that reason. I get the reasoning, but it's still unet

I still very strongly oppose HSTS's "No user recourse" policy, and don't deploy it on my sites purely for that reason. I get the reasoning, but it's still unethical to the user. (as an aside, hsts applies to all ports with no option to disable this, something to keep in mind.)

sjwright 8y ago
How is it unethical to protect your users from MITM attacks? Why would any end user need “recourse” to connect to your server incorrectly? If you’re no longer serving content over HTTP anyway, what opportunity is lost?
- MrStonedOne 8y ago
  I'm not an end user, and I should have the ability to bypass expired/invalid cert errors on both my own sites, as well any other site out of curiosity. Sure, lock it behind a flag or other hidden setting, that even covers enterprise clients because they already disable setting those on their domain computers, but it should be possible nonetheless to bypass the error.
  - sjwright 8y ago
    That's an objection to the exposed features in your web browser, not the normal use of HSTS by websites. Did you even try a Google Search?[0] If you use Firefox (which you should) it is possible to bypass that setting, using a feature locked behind "a flag or other hidden setting." Specifically, it is the about:config setting security.mixed_content.use_hstsc My suggestion is to use Firefox Developer Edition and modify the security setting there—allowing you to bypass HSTS whenever you like without any accidental security risk for your normal browsing. [0] https://campus.barracuda.com/product/websecurityagent/doc/73699516/how-to-clear-the-hsts-cache-or-disable-hsts-for-firefox/ https://campus.barracuda.com/product/websecurityagent/doc/73...
zzo38computer 8y ago
I agree with you. That is also why I hate HSTS and will not use it. The user must be given permission to override (for any reason they want to, including one you don't know) anything, and must have enough ropes to hang yourself and also a few more just in case. HSTS is terrible, even if you support HTTPS (which you probably should).
- sjwright 8y ago
  > I hate HSTS and will not use it. HSTS is just a flag. What you "hate" is that a piece of software under ~YOUR~ control (the web browser) happens to be correctly enforcing the intent of that flag. If you don't like HSTS, it is ~YOUR~ choice whether you use a web browser that will follow your instructions or someone else's. If your web browser does not offer a method to disable HSTS like Firefox does, switch to a browser that is willing to follow your instructions. > HSTS is terrible That is an absurd opinion. HSTS makes the internet objectively safer by requiring trust between your web browser and web servers. Who would want optional trust between themselves and their online bank to be the default state of affairs? If a website deals with money (or other items of value) and it is not HSTS preloaded, it is being stupidly and dangerously unsafe.
  - zzo38computer 8y ago
    I know that about the flag, and managed to hack Firefox so that HSTS won't work. (Although I wrote a document how to write a better web browser program, but it isn't implemented.) Trust between whatever (and other options about what features to enable/disable/alter, such as what fonts to use, any kind of URL redirections, etc) should be defined by the user. There are several reasons you may wish to alter the settings. (Anyways, you can configure cookies for secure connections only; the user should also be allowed to configure whether or not to use key pinning for secure cookies (individually per domain).) (I also think that both HTTP and HTTPS are bad for banking anyways, and that a specialized kind of bank/money protocol that can be worked over SSH might be working better (preferably that can be used with text, so that even without specialized software you can still do some stuff with it; IRC does that too and that is what makes IRC good). This is independent of the above stuff, though.)
odensc 8y ago
On Chrome, you can type `thisisunsafe` to skip it.

sjwright 8y ago

How is it unethical to protect your users from MITM attacks? Why would any end user need “recourse” to connect to your server incorrectly? If you’re no longer serving content over HTTP anyway, what opportunity is lost?

MrStonedOne 8y ago
I'm not an end user, and I should have the ability to bypass expired/invalid cert errors on both my own sites, as well any other site out of curiosity. Sure, lock it behind a flag or other hidden setting, that even covers enterprise clients because they already disable setting those on their domain computers, but it should be possible nonetheless to bypass the error.
- sjwright 8y ago
  That's an objection to the exposed features in your web browser, not the normal use of HSTS by websites. Did you even try a Google Search?[0] If you use Firefox (which you should) it is possible to bypass that setting, using a feature locked behind "a flag or other hidden setting." Specifically, it is the about:config setting security.mixed_content.use_hstsc My suggestion is to use Firefox Developer Edition and modify the security setting there—allowing you to bypass HSTS whenever you like without any accidental security risk for your normal browsing. [0] https://campus.barracuda.com/product/websecurityagent/doc/73699516/how-to-clear-the-hsts-cache-or-disable-hsts-for-firefox/ https://campus.barracuda.com/product/websecurityagent/doc/73...

zzo38computer 8y ago

I agree with you. That is also why I hate HSTS and will not use it. The user must be given permission to override (for any reason they want to, including one you don't know) anything, and must have enough ropes to hang yourself and also a few more just in case. HSTS is terrible, even if you support HTTPS (which you probably should).

sjwright 8y ago
> I hate HSTS and will not use it. HSTS is just a flag. What you "hate" is that a piece of software under ~YOUR~ control (the web browser) happens to be correctly enforcing the intent of that flag. If you don't like HSTS, it is ~YOUR~ choice whether you use a web browser that will follow your instructions or someone else's. If your web browser does not offer a method to disable HSTS like Firefox does, switch to a browser that is willing to follow your instructions. > HSTS is terrible That is an absurd opinion. HSTS makes the internet objectively safer by requiring trust between your web browser and web servers. Who would want optional trust between themselves and their online bank to be the default state of affairs? If a website deals with money (or other items of value) and it is not HSTS preloaded, it is being stupidly and dangerously unsafe.
- zzo38computer 8y ago
  I know that about the flag, and managed to hack Firefox so that HSTS won't work. (Although I wrote a document how to write a better web browser program, but it isn't implemented.) Trust between whatever (and other options about what features to enable/disable/alter, such as what fonts to use, any kind of URL redirections, etc) should be defined by the user. There are several reasons you may wish to alter the settings. (Anyways, you can configure cookies for secure connections only; the user should also be allowed to configure whether or not to use key pinning for secure cookies (individually per domain).) (I also think that both HTTP and HTTPS are bad for banking anyways, and that a specialized kind of bank/money protocol that can be worked over SSH might be working better (preferably that can be used with text, so that even without specialized software you can still do some stuff with it; IRC does that too and that is what makes IRC good). This is independent of the above stuff, though.)

odensc 8y ago

On Chrome, you can type `thisisunsafe` to skip it.