3 ms·

And even without HSTS, most web browsers bury the option to continue deep enough that for most users it could as well not exist. In Chrome you have to click "de

And even without HSTS, most web browsers bury the option to continue deep enough that for most users it could as well not exist. In Chrome you have to click "details" and there will be a tiny link to "continue anyway".

0xbadcafebee 6y ago
This is a vulnerability more than a benefit. If you need to access a website and can't because of ominous errors, most users will simply try a different device. If the user always browses a specific site on their desktop, and the desktop hits an HSTS warning, the user will immediately try it on their phone, which has never visited the site, and thus has no HSTS record, and will then click through any certificate warning. As far as the user is concerned, the website or their internet connection (or both) are just screwed up. Web browsers have never taken any of this seriously. Their hilariously poor UX around errors and warnings, their half-baked mitigation schemes, their reluctance to figure out new industry solutions for extremely common problems like setting up a wireless access point, etc.
- toast0 6y ago
  If you (as a site owner) care about HSTS, you'll likely get your site included in the preload list, which closes the other device loophole for the most part. (There certainly are some devices with browsers that don't get updates and/or don't do HSTS preload, but can't fix everyone).
  - 0xbadcafebee 6y ago
    The preload list is another crap web browser mitigation. "Hey, we have this problem with our browsers where the security is trivially defeated a number of ways. What are we gonna do about it? ......... I got it! We'll make extra security optional!" As a regular web user, I should be able to know if the site I'm using is secure from MITM. But that's basically unknowable, because for any given site you're on, there may be a half dozen different kinds of duct tape implemented in different ways. I just have to hope nobody wants to hack me. All the mitigations might as well not exist.

0xbadcafebee 6y ago

This is a vulnerability more than a benefit. If you need to access a website and can't because of ominous errors, most users will simply try a different device. If the user always browses a specific site on their desktop, and the desktop hits an HSTS warning, the user will immediately try it on their phone, which has never visited the site, and thus has no HSTS record, and will then click through any certificate warning. As far as the user is concerned, the website or their internet connection (or both) are just screwed up. Web browsers have never taken any of this seriously. Their hilariously poor UX around errors and warnings, their half-baked mitigation schemes, their reluctance to figure out new industry solutions for extremely common problems like setting up a wireless access point, etc.

toast0 6y ago
If you (as a site owner) care about HSTS, you'll likely get your site included in the preload list, which closes the other device loophole for the most part. (There certainly are some devices with browsers that don't get updates and/or don't do HSTS preload, but can't fix everyone).
- 0xbadcafebee 6y ago
  The preload list is another crap web browser mitigation. "Hey, we have this problem with our browsers where the security is trivially defeated a number of ways. What are we gonna do about it? ......... I got it! We'll make extra security optional!" As a regular web user, I should be able to know if the site I'm using is secure from MITM. But that's basically unknowable, because for any given site you're on, there may be a half dozen different kinds of duct tape implemented in different ways. I just have to hope nobody wants to hack me. All the mitigations might as well not exist.