4 ms·
How is it unethical to protect your users from MITM attacks? Why would any end user need “recourse” to connect to your server incorrectly? If you’re no longer
by sjwright 8y ago
How is it unethical to protect your users from MITM attacks?
Why would any end user need “recourse” to connect to your server incorrectly?
If you’re no longer serving content over HTTP anyway, what opportunity is lost?
- MrStonedOne 8y agoI'm not an end user, and I should have the ability to bypass expired/invalid cert errors on both my own sites, as well any other site out of curiosity. Sure, lock it behind a flag or other hidden setting, that even covers enterprise clients because they already disable setting those on their domain computers, but it should be possible nonetheless to bypass the error.
- sjwright 8y agoThat's an objection to the exposed features in your web browser, not the normal use of HSTS by websites. Did you even try a Google Search?[0] If you use Firefox (which you should) it is possible to bypass that setting, using a feature locked behind "a flag or other hidden setting." Specifically, it is the about:config setting security.mixed_content.use_hstsc My suggestion is to use Firefox Developer Edition and modify the security setting there—allowing you to bypass HSTS whenever you like without any accidental security risk for your normal browsing. [0] https://campus.barracuda.com/product/websecurityagent/doc/73699516/how-to-clear-the-hsts-cache-or-disable-hsts-for-firefox/ https://campus.barracuda.com/product/websecurityagent/doc/73...