6 ms·

You can bypass the Chrome dialog by typing "thisisunsafe" in the error page.

by bzb3 6y ago

freehunter 6y ago
That's a stupidly hidden way to go about it.
- dylz 6y ago
  IIRC, the intent is that no one should be doing this and anyone doing it should be at least technical enough to figure out what they're doing and be reminded that it's a bad idea.
  - freehunter 6y ago
    And instead many people will just do a Google search for "Chrome [insert error here]" and run the first command they find, while people like me will say "okay I'll just Firefox where I can click past this warning".
    - dylz 6y ago
      For what it's worth I've always been able to click straight through a self-signed cert on Chrome - in fact I just did it right now to log in to something internal. I am a nearly 50-50 split Firefox/Chrome user. Are you sure you aren't sending HSTS headers that demand the site be TLS in some way? Also, have you considered the slightly-saner way of doing it, which is making an internal self-signed CA, trusting that internal CA, and then having it sign the rest of your "self dev stuff" certs?
      - freehunter 6y ago
        If it was HSTS it wouldn't load in Firefox, would it?
        dylz 6y ago
        If it was HSTS it would not load in both, with no button to bypass. If it was not HSTS you can click through a non-obvious button in both.
        freehunter 6y ago
        Well Chrome has no button and Firefox has a button, so...
  - Wowfunhappy 6y ago
    Yeah, I actually think these sorts of strategies are clever. They're a way to protect normal users without outright barring power users from doing as they wish. macOS operates in a similar way. I really like how the difficulty increases depending on the task: • Want to allow one app through Gatekeeper? Instead of double-clicking the app icon directly, right click it and select "open". • Want to turn off Gatekeeper for all apps? You need to open the Terminal and execute a command. • Want to turn off System Integrity Protection? You need to reboot your computer into recovery mode and execute a Terminal command there.
    - lostcolony 6y ago
      Except for those of us who are finding out about it only via a Hacker News comment. As happened with this user, who seems, you know, sufficiently a power user to need that info. Even a "if you know this site to be safe, please read this knowledge base article (link)" and buried in that, amidst all the reasons you shouldn't use untrusted certs, are the instructions.
      - londons_explore 6y ago
        If you keep up to date with commits on the chromium code repo, you'd see them change it from time to time. For a while it was 'youshallnotpass'. You probably shouldn't be using an opensource project without at least a cursory glance at the code anyway, especially as a power user.
        lostcolony 6y ago
        You're kidding right? You look at every commit of every open source app you use, or that a closed source app is built atop? For me, off the top of my head, that would mean, yes, Chrome, Firefox, the Linux Kernel, Libre Office, Android, VLC...probably plenty more that I am unaware are open source, and that's not even considering the dev tools to do my job. When would I actually have time to have a life?
        skykooler 6y ago
  - jschwartzi 6y ago
    On the other hand these stupid dialog tricks are why I stopped using Chrome. I'm not an idiot and I know what I'm doing. It's pretty arrogant to assume that I shouldn't be visiting my router's configuration page just because it uses a self-signed certificate. I don't care to set up an X.509 infrastructure at my house, thank you. Please stop mollycoddling me. Firefox continues to do a good job of just letting me visit the damn website after warning me.
    - dylz 6y ago
      I'm confused - Firefox and Chrome act completely identically to a self signed cert for me. Both let me click through after looking at the cert or expanding a section. I have never been "blocked" by some hidden modal unless the site chooses to be HSTS-enforcing, and in that case Firefox does not allow a clickthrough either. Both examples on latest current, taken right now: Firefox: https://i.imgur.com/4VMjDZ4.png https://i.imgur.com/4VMjDZ4.png Chrome: https://i.imgur.com/YosvXEu.png https://i.imgur.com/YosvXEu.png For HSTS, both Firefox and Chrome act identically and do not allow clickthrough: https://i.imgur.com/WPCTep1.png https://i.imgur.com/WPCTep1.png
      - maest 6y ago
        Youre confused because you're not using Chrome on OSX: on osx there's no "Proceed to <website>" option.
        gowld 6y ago
        https://support.google.com/chrome/thread/23226743?hl=en https://support.google.com/chrome/thread/23226743?hl=en
        dylz 6y ago
        I'm now even more confused: https://i.imgur.com/jl9agwG.png https://i.imgur.com/jl9agwG.png
        freehunter 6y ago
tracker1 6y ago
Reminds me of the default admin password for an app I've worked on... "You should change me."

You can bypass the Chrome dialog by typing "thisisunsafe" in the error page.

by bzb3 6y ago

You can bypass the Chrome dialog by typing "thisisunsafe" in the error page.

freehunter 6y ago

That's a stupidly hidden way to go about it.

dylz 6y ago
IIRC, the intent is that no one should be doing this and anyone doing it should be at least technical enough to figure out what they're doing and be reminded that it's a bad idea.
- freehunter 6y ago
  And instead many people will just do a Google search for "Chrome [insert error here]" and run the first command they find, while people like me will say "okay I'll just Firefox where I can click past this warning".
  - dylz 6y ago
    For what it's worth I've always been able to click straight through a self-signed cert on Chrome - in fact I just did it right now to log in to something internal. I am a nearly 50-50 split Firefox/Chrome user. Are you sure you aren't sending HSTS headers that demand the site be TLS in some way? Also, have you considered the slightly-saner way of doing it, which is making an internal self-signed CA, trusting that internal CA, and then having it sign the rest of your "self dev stuff" certs?
    - freehunter 6y ago
      If it was HSTS it wouldn't load in Firefox, would it?
      - dylz 6y ago
        If it was HSTS it would not load in both, with no button to bypass. If it was not HSTS you can click through a non-obvious button in both.
        freehunter 6y ago
        Well Chrome has no button and Firefox has a button, so...
- Wowfunhappy 6y ago
  Yeah, I actually think these sorts of strategies are clever. They're a way to protect normal users without outright barring power users from doing as they wish. macOS operates in a similar way. I really like how the difficulty increases depending on the task: • Want to allow one app through Gatekeeper? Instead of double-clicking the app icon directly, right click it and select "open". • Want to turn off Gatekeeper for all apps? You need to open the Terminal and execute a command. • Want to turn off System Integrity Protection? You need to reboot your computer into recovery mode and execute a Terminal command there.
  - lostcolony 6y ago
    Except for those of us who are finding out about it only via a Hacker News comment. As happened with this user, who seems, you know, sufficiently a power user to need that info. Even a "if you know this site to be safe, please read this knowledge base article (link)" and buried in that, amidst all the reasons you shouldn't use untrusted certs, are the instructions.
    - londons_explore 6y ago
      If you keep up to date with commits on the chromium code repo, you'd see them change it from time to time. For a while it was 'youshallnotpass'. You probably shouldn't be using an opensource project without at least a cursory glance at the code anyway, especially as a power user.
      - lostcolony 6y ago
        You're kidding right? You look at every commit of every open source app you use, or that a closed source app is built atop? For me, off the top of my head, that would mean, yes, Chrome, Firefox, the Linux Kernel, Libre Office, Android, VLC...probably plenty more that I am unaware are open source, and that's not even considering the dev tools to do my job. When would I actually have time to have a life?
        skykooler 6y ago
- jschwartzi 6y ago
  On the other hand these stupid dialog tricks are why I stopped using Chrome. I'm not an idiot and I know what I'm doing. It's pretty arrogant to assume that I shouldn't be visiting my router's configuration page just because it uses a self-signed certificate. I don't care to set up an X.509 infrastructure at my house, thank you. Please stop mollycoddling me. Firefox continues to do a good job of just letting me visit the damn website after warning me.
  - dylz 6y ago
    I'm confused - Firefox and Chrome act completely identically to a self signed cert for me. Both let me click through after looking at the cert or expanding a section. I have never been "blocked" by some hidden modal unless the site chooses to be HSTS-enforcing, and in that case Firefox does not allow a clickthrough either. Both examples on latest current, taken right now: Firefox: https://i.imgur.com/4VMjDZ4.png https://i.imgur.com/4VMjDZ4.png Chrome: https://i.imgur.com/YosvXEu.png https://i.imgur.com/YosvXEu.png For HSTS, both Firefox and Chrome act identically and do not allow clickthrough: https://i.imgur.com/WPCTep1.png https://i.imgur.com/WPCTep1.png
    - maest 6y ago
      Youre confused because you're not using Chrome on OSX: on osx there's no "Proceed to <website>" option.
      - gowld 6y ago
        https://support.google.com/chrome/thread/23226743?hl=en https://support.google.com/chrome/thread/23226743?hl=en
      - dylz 6y ago
        I'm now even more confused: https://i.imgur.com/jl9agwG.png https://i.imgur.com/jl9agwG.png
        freehunter 6y ago

tracker1 6y ago

Reminds me of the default admin password for an app I've worked on... "You should change me."