3 ms·
That's not the request being made. What people want is for the button that says "this expired cert is fine, whatever" to still be available for hsts https sites
by tedunangst 5y ago
That's not the request being made. What people want is for the button that says "this expired cert is fine, whatever" to still be available for hsts https sites.
- tptacek 5y agoI guess I don't understand what that has to do with HSTS, which was not designed for that button.
- tedunangst 5y agoWhen an HSTS locked site has an expired cert, the browser takes away the "it's okay" button.
- tptacek 5y agoNo, I get that. I get how you can reasonably argue about that feature. I don't get how you can argue that feature suggests we shouldn't stop SSL stripping at all.
- ocdtrekkie 5y agoBasically, on any ordinary HTTPS site, every browser can allow you to proceed despite a certificate error. Such as knowing the certificate is expired or revoked or not from a known CA or something. HSTS by specification prohibits browsers from offering that option. So I can know a server is serving valid, authentic traffic via HTTPS, be aware of why the certificate has an issue, and HSTS requires that my browser prohibit me from connecting to the server.