4 ms·

Its worst than that. Google chrome doesn't like more sites than others. On most you can simply click "proceed to danger" and ignore missing cert. On some other

Its worst than that. Google chrome doesn't like more sites than others. On most you can simply click "proceed to danger" and ignore missing cert. On some other like cryptome, they don't even give you option to continue. https://cryptome.org/ https://cryptome.org/

judge2020 5y ago
This is generally enforced by HSTS - one of the features is that, if the site has it enabled and the site has a TLS-related error, the browsers prevent users from bypassing the SSL error screen (at least, without typing `thisisunsafe` in chrome). https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/St... https://security.stackexchange.com/q/195688/96942 https://security.stackexchange.com/q/195688/96942
weedfroglozenge 5y ago
I'm glad I saw this comment - What can make a site perform like that? At work we use Chrome as our general browser, and we've had several issues with expired certs before. Some websites allowed you to expand the box and opt "Continue" but some simply didn't have the option. Whats the difference?
- eropple 5y ago
  Sites can opt into "do not let somebody continue if the cert is bad" via HSTS.
- bmcahren 5y ago
  HTTP Strict Transport Security (HSTS) is enabled at the DNS level which tells modern browsers "I'm a modern website and want to only be served on valid certificates, otherwise refuse to allow access to my website because something must be very wrong for this to happen". The assumption is "must be very wrong" is an attack you don't want people to "continue" past. Occasionally it bites back like this if you don't maintain your certificates. Offering HTTP transport invites attackers to inject advertisements, malware, or viruses into your packet stream. ISP like comcast and ATT are notorious for doing this. Allowing falsified or expired certificates invites attackers as well. HTST This is a good thing.
  - Dylan16807 5y ago
    DNS? You announce it with a header or get on the preload list. I don't think there's a DNS method.
    - dagenix 5y ago
      Yeah, there is no DNS mechanism. Although, IIRC, it is possible to place an entire TLD on the preload list - which still doesn't use DNS, but its a mechanism to enable HSTS where the website itself doesn't do anything.
oefrha 5y ago
Like others said, the site is using HSTS: > curl -sSk -D- https://cryptome.org/ -o /dev/null | grep strict-transport-security strict-transport-security: max-age=31536000 But even then, Chrome 91 on both macOS and Windows totally does allow me to Proceed to cryptome.org (unsafe) Maybe it's only offered because I never visited the site in the past?
gfody 5y ago
Firefox 88 here, cryptome.org loads with a red exclamation warning icon in the address bar, w3.org refuses to load and when I click on "advanced" there is not even an "accept risk and continue" option. I don't even know how to load w3.org right now if I had to.

judge2020 5y ago

This is generally enforced by HSTS - one of the features is that, if the site has it enabled and the site has a TLS-related error, the browsers prevent users from bypassing the SSL error screen (at least, without typing `thisisunsafe` in chrome). https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/St... https://security.stackexchange.com/q/195688/96942 https://security.stackexchange.com/q/195688/96942

weedfroglozenge 5y ago

I'm glad I saw this comment - What can make a site perform like that? At work we use Chrome as our general browser, and we've had several issues with expired certs before. Some websites allowed you to expand the box and opt "Continue" but some simply didn't have the option. Whats the difference?

eropple 5y ago
Sites can opt into "do not let somebody continue if the cert is bad" via HSTS.
bmcahren 5y ago
HTTP Strict Transport Security (HSTS) is enabled at the DNS level which tells modern browsers "I'm a modern website and want to only be served on valid certificates, otherwise refuse to allow access to my website because something must be very wrong for this to happen". The assumption is "must be very wrong" is an attack you don't want people to "continue" past. Occasionally it bites back like this if you don't maintain your certificates. Offering HTTP transport invites attackers to inject advertisements, malware, or viruses into your packet stream. ISP like comcast and ATT are notorious for doing this. Allowing falsified or expired certificates invites attackers as well. HTST This is a good thing.
- Dylan16807 5y ago
  DNS? You announce it with a header or get on the preload list. I don't think there's a DNS method.
  - dagenix 5y ago
    Yeah, there is no DNS mechanism. Although, IIRC, it is possible to place an entire TLD on the preload list - which still doesn't use DNS, but its a mechanism to enable HSTS where the website itself doesn't do anything.

oefrha 5y ago

Like others said, the site is using HSTS: > curl -sSk -D- https://cryptome.org/ -o /dev/null | grep strict-transport-security strict-transport-security: max-age=31536000 But even then, Chrome 91 on both macOS and Windows totally does allow me to Proceed to cryptome.org (unsafe) Maybe it's only offered because I never visited the site in the past?

gfody 5y ago

Firefox 88 here, cryptome.org loads with a red exclamation warning icon in the address bar, w3.org refuses to load and when I click on "advanced" there is not even an "accept risk and continue" option. I don't even know how to load w3.org right now if I had to.