4 ms·

TLS is useful and should be the default for everything; However, it is not the protection everyone seems to assume it is for several reasons: 1. Users generall

TLS is useful and should be the default for everything; However, it is not the protection everyone seems to assume it is for several reasons: 1. Users generally still click "Accept & Continue" when they see certificate warnings. 2. A given app can easily disable certificate validation and blindly trust the other end. For web browsers, great they do it well. Other applications often disable certificate validation altogether. Plenty of mobile apps I've seen fail to do proper certificate validation, though thankfully it is becoming less common thanks to vendor platforms removing the option to be horribly insecure. 3. An attacker can still see which domain names and/or hostnames you're accessing. The simplest useful thing I could think of with this might be is finding a given WiFi network's IP on the Internet, in those circumstances where the hardware permits you to create your own frames.

tialaramex 5y ago
> 1. Users generally still click "Accept & Continue" when they see certificate warnings. In Firefox HSTS blocks this entirely. There is no "Accept" option at all. In Chrome HSTS means the only way to "accept and continue" is to type whatever the current magic bypass phrase is, the ordinary "accept and continue" option isn't there.
- grishka 5y ago
  And even without HSTS, most web browsers bury the option to continue deep enough that for most users it could as well not exist. In Chrome you have to click "details" and there will be a tiny link to "continue anyway".
  - 0xbadcafebee 5y ago
    This is a vulnerability more than a benefit. If you need to access a website and can't because of ominous errors, most users will simply try a different device. If the user always browses a specific site on their desktop, and the desktop hits an HSTS warning, the user will immediately try it on their phone, which has never visited the site, and thus has no HSTS record, and will then click through any certificate warning. As far as the user is concerned, the website or their internet connection (or both) are just screwed up. Web browsers have never taken any of this seriously. Their hilariously poor UX around errors and warnings, their half-baked mitigation schemes, their reluctance to figure out new industry solutions for extremely common problems like setting up a wireless access point, etc.
    - toast0 5y ago
      If you (as a site owner) care about HSTS, you'll likely get your site included in the preload list, which closes the other device loophole for the most part. (There certainly are some devices with browsers that don't get updates and/or don't do HSTS preload, but can't fix everyone).
      - 0xbadcafebee 5y ago
        The preload list is another crap web browser mitigation. "Hey, we have this problem with our browsers where the security is trivially defeated a number of ways. What are we gonna do about it? ......... I got it! We'll make extra security optional!" As a regular web user, I should be able to know if the site I'm using is secure from MITM. But that's basically unknowable, because for any given site you're on, there may be a half dozen different kinds of duct tape implemented in different ways. I just have to hope nobody wants to hack me. All the mitigations might as well not exist.
Bulpi 5y ago
I'm already disagreeing with your main point 1) My parents don't know how to do this and would call me and stop trying to 'solve it' Chrome and Firefox are quite visual in this regard.
foobarbecue 5y ago
thisisunsafe...
Wowfunhappy 5y ago
> Users generally still click "Accept & Continue" when they see certificate warnings. I am one of these users. However, that doesn't mean the warning isn't useful—it puts me on high alert! I enter these websites knowing that I shouldn't trust any information I see, and that I shouldn't enter anything important. I am of course more technically inclined than the average user, so I don't know that my behavior is broadly applicable. Even so, I wonder if this metric necessarily means what it seems to mean.

tialaramex 5y ago

> 1. Users generally still click "Accept & Continue" when they see certificate warnings. In Firefox HSTS blocks this entirely. There is no "Accept" option at all. In Chrome HSTS means the only way to "accept and continue" is to type whatever the current magic bypass phrase is, the ordinary "accept and continue" option isn't there.

grishka 5y ago
And even without HSTS, most web browsers bury the option to continue deep enough that for most users it could as well not exist. In Chrome you have to click "details" and there will be a tiny link to "continue anyway".
- 0xbadcafebee 5y ago
  This is a vulnerability more than a benefit. If you need to access a website and can't because of ominous errors, most users will simply try a different device. If the user always browses a specific site on their desktop, and the desktop hits an HSTS warning, the user will immediately try it on their phone, which has never visited the site, and thus has no HSTS record, and will then click through any certificate warning. As far as the user is concerned, the website or their internet connection (or both) are just screwed up. Web browsers have never taken any of this seriously. Their hilariously poor UX around errors and warnings, their half-baked mitigation schemes, their reluctance to figure out new industry solutions for extremely common problems like setting up a wireless access point, etc.
  - toast0 5y ago
    If you (as a site owner) care about HSTS, you'll likely get your site included in the preload list, which closes the other device loophole for the most part. (There certainly are some devices with browsers that don't get updates and/or don't do HSTS preload, but can't fix everyone).
    - 0xbadcafebee 5y ago
      The preload list is another crap web browser mitigation. "Hey, we have this problem with our browsers where the security is trivially defeated a number of ways. What are we gonna do about it? ......... I got it! We'll make extra security optional!" As a regular web user, I should be able to know if the site I'm using is secure from MITM. But that's basically unknowable, because for any given site you're on, there may be a half dozen different kinds of duct tape implemented in different ways. I just have to hope nobody wants to hack me. All the mitigations might as well not exist.

Bulpi 5y ago

I'm already disagreeing with your main point 1) My parents don't know how to do this and would call me and stop trying to 'solve it' Chrome and Firefox are quite visual in this regard.

foobarbecue 5y ago

thisisunsafe...

Wowfunhappy 5y ago

> Users generally still click "Accept & Continue" when they see certificate warnings. I am one of these users. However, that doesn't mean the warning isn't useful—it puts me on high alert! I enter these websites knowing that I shouldn't trust any information I see, and that I shouldn't enter anything important. I am of course more technically inclined than the average user, so I don't know that my behavior is broadly applicable. Even so, I wonder if this metric necessarily means what it seems to mean.