4 ms·

Chrome wasn't even giving me the option to proceed, something about HSTS.. Unsure I just know the option was not there.

• Wowfunhappy 5y ago
  It will let you in if you type `thisisunsafe`.
  • peterburkimsher 5y ago
    Nice tip! I tried that, but then the company firewall blocked it for the same reason. (zscaler Access denied due to bad server certificate)
• sp332 5y ago
  Right, the website can opt-in to requiring TLS for connections. Browsers can choose to honor this and disallow all plain HTTP connections... and all TLS connections with "invalid" certificates. https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security It's a great way for site admins to turn a minor certificate issue into a complete disaster :(
  • charrondev 5y ago
    If you don’t use HSTS you open your users up to downgrade attacks. https://auth0.com/blog/preventing-https-downgrade-attacks/ https://auth0.com/blog/preventing-https-downgrade-attacks/
• dilyevsky 5y ago
  That’s the whole point of hsts. Won’t work on safari either. I don’t use chrome and won’t recommend it but if you have to view it you can clear hsts for that domain in chrome://settings
  • Rapzid 5y ago
    The point is taking the option away from users to proceed if there is a cert issue? Really it's not.
    • dilyevsky 5y ago
      That’s exactly right. Really it is - please review https://en.m.wikipedia.org/wiki/HTTP_Strict_Transport_Security https://en.m.wikipedia.org/wiki/HTTP_Strict_Transport_Securi...
      • Rapzid 5y ago
        The main event is preventing silent security downgrades. Hiding proceed behind a secret code like it's a 90s NES game is a side show. They should have just made it the Double Dragon cheat code.
        • dilyevsky 5y ago
          This option is likely there for testing only and not meant for use by regular users. Hence it’s not present in regular settings ui afaik. Would you prefer drm-style lock? That’s clearly going overboard