12 ms·
I don't care about HSTS for localhost
- ocdtrekkie 4y agoI absolutely care. About how absolutely cursed HSTS is as a concept. It's basically the EME of TLS. The idea that they put it right in the specification that browsers were prohibited from allowing users to bypass it, even if they know what they're doing, fully moved browsers out of the "user agent" category.
- dinosaurdynasty 4y agoEME of TLS? They put that requirement in there because HSTS is pointless without it. The website is literally saying "we will always (w/ expiration) have valid TLS, if we don't that's a problem". Allowing users to bypass it allows criminals to go "oh we're having problems with the cert, just type 'badidea' and click yes to continue to be hacked".
- ocdtrekkie 4y agoA user agent must work for the user, not the server. Obeying the server over the user's intent is malicious design. And if that makes it pointless, then just remove it entirely. Believe it or not, I've never seen a cert error in the wild that wasn't an expiration of a valid cert or a misconfiguration. The boogeyman of MITM attacks which PKI certs protect from is used to justify a lot of terrible changes to the web that aren't reflected by reality: In most cases they're just going to hack the real server and serve malicious content from your valid certificate anyways. Or they'll trick someone into giving their credentials to bonkofamerica.com because people are easy to fool. Why MITM Amazon when people will happily treat an order email sent from a Gmail account as legitimate?
- toomim 4y agoPreach! Power to the User!
- notriddle 4y ago> I've never seen a cert error in the wild that wasn't an expiration of a valid cert or a misconfiguration. I have. Usually caused by a captive portal. > The boogeyman of MITM attacks which PKI certs protect from is used to justify a lot of terrible changes to the web that aren't reflected by reality. The move to use HTTPS everywhere was started in response to packet sniffing tools like Firesheep. That’s not a boogeyman; it’s a proof of concept that works in realistic scenarios. > Why MITM Amazon when people will happily treat an order email sent from a Gmail account as legitimate? So what? How about solving both problems?
- ocdtrekkie 4y agoCaptive portals aren't malicious. They're arguably helpful. But I've never seen a captive portal using fake certificates either.
- justsomehnguy 4y ago> But I've never seen a captive portal using fake certificates either. I never seen a captive portal using a valid certificate either. Not like I saw many captive portals (last time was like... 2018?) but still.
- notriddle 4y agoWhether they’re malicious or not, I don’t want to send them the session cookie for an unrelated website.
- Thorrez 4y ago>I've never seen a cert error in the wild that wasn't an expiration of a valid cert or a misconfiguration. Here's one example: https://www.engadget.com/2018-04-25-hackers-dns-phishing-scam-cryptocurrency-myetherwallet.html https://www.engadget.com/2018-04-25-hackers-dns-phishing-sca...
- Thorrez 4y ago>HSTS is pointless without it No. If I click an http:// http:// link, I want that link to be upgraded automatically to https:// https:// if possible so that MITMs can't read or modify the request or response. I would still get that benefit if the browser made it easy to click through certificate warnings.
- lilyball 4y agoIf you're being MITM'd then you'll get a certificate warning. If it's easy to click through those then it's easy for MITMs to read or modify the request.
- Thorrez 4y agoI'm talking about my own safety. I won't click through it.
- lilyball 4y agoIf you won't click through it, then why do you want the browser to let you click through it?
- Thorrez 4y agoDid I say I want the browser to let me click through it? However, in general I think the browser preventing the user from doing something the user wants is a bit offputting. The browser is a "user agent". It should act on behalf of the user. If the user wants it to do something, it should do that. This case is tricky, because sometimes what the user really wants is not what the user is asking the user agent to do. It's an xy problem. I think Chrome's current behavior strikes a nice balance.
- Thorrez 4y ago>Allowing users to bypass it allows criminals to go "oh we're having problems with the cert, just type 'badidea' and click yes to continue to be hacked". Are you using this as an example of how HSTS is helping users now? Because Chrome allows you to type 'thisisunsafe' and you'll get through the warning, regardless of HSTS.
- zzo38computer 4y agoI also dislike HSTS. I modified the .so file so that it does not recognize the Strict-Transport-Security header. (There are many other features that are also bad, but HSTS is especially bad.) The browser MUST allow the end user to override EVERYTHING (and assume that you know what you are doing, instead of trying to do things for you differently than what you did), and then it will be good.
- arealaccount 4y agoIts not really obviously documented but you can type “thisisunsafe” when you get the unpassable hsts screen and it will bypass.
- ocdtrekkie 4y agoIs that a Chrome thing? I'm a Firefox user, generally. But my understanding is if the browser allows any sort of bypass it is not compliant with the spec.
- arealaccount 4y agoYes chrome only afaik. Im firefox as well, but sometimes I have to switch because the FF debugger will give up in certain cases.
- baisq 4y agoFirefox doesn't allow you to bypass it at all in recent versions. One of the many, many reasons not to use it. Less power to the user.
- tialaramex 4y agoYes, I have had this discussion with Google staff. Their opinion is that "thisisunsafe" is not really a bypass even though that's obviously exactly what it is and exactly how it is used. Historically there have been several phrases used, with changes once every few years, and the weak argument is that people who go to the bother of learning each new phrase, plus the fact the phrase tells you it's a bad idea (one of them literally) would bypass this anyway, but well... would they? Human psychology doesn't work that way. People get into the habit of typing whatever the magic phrase is and then they're astonished that it was a bad idea even though it just said so. You can't build effective security systems on such foundations.
- Wowfunhappy 4y agoThis is where I fundamentally disagree with a lot of security folks: if the the user is really, truly, absolutely sure that they want to shoot themselves in the foot, you should let them. It's their life to live.
- Thorrez 4y agoHSTS is weird. It does 2 completely separate things: 1. Automatically redirect from http:// http:// to https:// https:// . 2. Make it difficult to bypass the certificate warning screen. 1 I think is very good. 2 is questionable.
- ocdtrekkie 4y agoYeah, I have no issue with a site indicating it only wants to talk over HTTPS. But to disable my ability to proceed even if I know what's going on with the site in question is constantly irritating.
- mistrial9 4y agoI am alarmed at the new behavior of Firefox in Ubuntu snapd -- "update your browser -- close this msg within 13 days to avoid interruption" a newly installed browser.. for the non-specialists here is an overview of the topic https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security
- ornxka 4y agoWait, Chrome is now requiring HSTS for localhost? This is absolute madness. Somebody needs to sit down with the people responsible for this and explain to them that this is not solving anybody's problems and is just making life more difficult for everyone.
- dinosaurdynasty 4y agoThis sounds like if you create a custom CA, import it, create a cert for localhost, and then connect Chrome to https://localhost https://localhost and it sends an HSTS header that Chrome accepts. Which is something you probably shouldn't be doing in the first place. Browsers aren't supposed to accept HSTS on self-signed certs so connecting to a self signed localhost shouldn't do this.
- throw1230 4y ago> Browsers aren't supposed to accept HSTS on self-signed certs so connecting to a self signed localhost shouldn't do this. There's nothing against self signed certificates working with HSTS at all. It's perfectly fine for browsers to accept HSTS regardless of who signed it.
- remram 4y agoI think the point is that if you add a temporary exception to accept the unverified certificate, you shouldn't be left with a permanent requirement that localhost have a certificate in the future because of the HSTS header you got during that time.
- aaronmdjones 4y ago> There's nothing against self signed certificates working with HSTS at all. Actually, there is. Section 8.1 of RFC 6797 opens with: "If an HTTP response, received over a secure transport, includes an STS header field, conforming to the grammar specified in Section 6.1, and there are no underlying secure transport errors or warnings (see Section 8.4), [...]" Section 8.4 then goes on to define "errors or warnings" as including any errors caused by UA certificate validity checks. Additionally, section 14.3 opens with: "The user agent processing model defined in Section 8 stipulates that a host is initially noted as a Known HSTS Host, or that updates are made to a Known HSTS Host's cached information, only if the UA receives the STS header field over a secure transport connection having no underlying secure transport errors or warnings." (and then goes on to provide the rationale for this decision) > It's perfectly fine for browsers to accept HSTS regardless of who signed it. No, it isn't. This enables active attackers to cause a permanent denial of service even when you subsequently move out of their reach. That's the rationale.
- armchairhacker 4y agoRelated: Firefox will restrict the behavior of loading scripts and assets via file:// from other file:// scripts. See https://stackoverflow.com/questions/58067499/runing-javascript-in-local-html-files-in-firefox https://stackoverflow.com/questions/58067499/runing-javascri..., and I think there is another flag you need to disable as well. Why is that? I definitely get blocking file:// scripts from any other protocol, and even blocking file:// scripts outside of the webpage's directory. But if you can get a user to open a webpage on their local machine, in the same folder as sensitive data, you mine as well just get them to run an arbitrary program.
- esprehn 4y agoIn general that's not true. Folks save web pages to their desktop or downloads folder all the time, when opening a saved Wikipedia .html file people don't assume it can then read every other file on your desktop. Worse would be if you saved it to your Documents or ~. Web pages are assumed to be "safe" by users, like a pdf or a png.
- Aeolun 4y agoSafe like a PDF is probably a good equivalent :)
- deleted 4y ago[deleted]
- egberts1 4y agoPlease consult CVE for numerous citations on PDF file. Furthermore, PDF also runs JavaScript, their Kind of JavaScript, depending on where you downloaded it from.
- saurik 4y agoAn exploit in the renderer isn't the same as supported dangerous behavior.
- 4y ago
- jez 4y agoHSTS doesn’t apply to websites served by directly connecting to an IP address, right? (I couldn’t find any layman’s docs that said it in so many words, nor did I want to test it locally. My guess comes from a reading of section 8.1.1 in the HSTS RFC[1].) I’ve been using 127.0.0.1:4000 or 0.0.0.0:4000 for local web development for a while now and have not really been held back. Maybe people who have fancier local development setups can’t use an IP address for some reason and instead have to use localhost? But it seems to me like the easiest workaround is not to load some formatted plist file into chrome but rather to rewrite the address bar slightly. [1] https://www.rfc-editor.org/rfc/rfc6797#section-8.1.1 https://www.rfc-editor.org/rfc/rfc6797#section-8.1.1
- oefrha 4y agoThat's correct, HSTS doesn't apply to IP literals. You can check with https://1.1.1.1/ https://1.1.1.1/. They would serve you an HSTS header: $ curl -sS -D- -o/dev/null https://1.1.1.1/ | grep -i strict-transport-security strict-transport-security: max-age=31536000 but you won't find 1.1.1.1 in chrome://net-internals/#hsts, and you can still directly request http://1.1.1.1/ http://1.1.1.1/, which returns a remote 301 response. Unlike for an HSTS domain, for which you get a local 307 response with a Non-Authoritative-Reason: HSTS header (in Chrome).
- deleted 4y ago[deleted]
- johnny_reilly 4y agoI feel like I'm going to be denounced as a heretic, but here goes: I don't care about HTTPS for localhost When developing locally I'll aim to run without HTTPS / HSTS etc - whilst I'm generally fairly passionate about narrowing the gap between local development and your deployed setup, using HTTPS locally often results in hours of yak shaving. There. I said it.
- wonnage 4y agoLots of stuff like service workers will only work over https
- magicalist 4y agolocalhost is considered a secure context by browsers so service workers will work from there even without https.
- eternityforest 4y agoI always worry someone is going to take this away, but it seems they haven't yet, and all is well so far.
- bugmen0t 4y agolocalhost is in the Secure Context specification. It won’t be taken away.
- TedDoesntTalk 4y agoSpecifications can change.
- d1sxeyes 4y agoAlthough this is true, it's also true that not all 'secure' functionality is enabled for localhost without HTTPS. One such example is secure cookies. There's a longer list here: https://web.dev/when-to-use-local-https/ https://web.dev/when-to-use-local-https/
- pxeger1 4y agoPro tip: you can use any subdomain of localhost (like app1.localhost) to get a separate origin that still resolves to 127.0.0.1 I've found this most useful for testing CORS and similar web features that depend on the origin, but I guess it could be helpful for HTTPS-related things too.
- sureglymop 4y agoOr even better, you could just route anything to 127.0.0.x locally. E.g. replicate the actual production deployment locally.
- anamexis 4y agoWouldn’t that require having an HTTPS stack and valid production certificates locally?
- tialaramex 4y agoYes. The browser cares about names (a number is a name, but a name isn't just a number) the loopback is special (it has "Secure Context" and thus gets the same privileges as URLs with HTTPS schemes) and most systems ensure that the name localhost is always defined to be the loopback so that gets to be special, but some.other.example even if it looks up as 127.0.0.1 is not special, and the browser expects the server it's talking with to prove it is really some.other.example which it probably can't do.
- forty 4y agoYou don't need valid production certificates, just valid certificates for that domain name, signed by a CA you trust. The nuance is that you can use a local CA to get a valid certificate, rather than using a production one (which you don't want to have on your computer - I mean the private part of it of course)
- dgb23 4y agoThat’s how I do it too. I think at some point I had to because of ServiceWorkers.
- numpad0 4y agoI find it kind of odd that there is no canonical, "POSIX" location for TLS host certificate. In lower parts of Web3/CSS/TLS/TCP/IP, there is /etc/resolv.conf, /var/log/messages, /etc/ssh/ssh_host_rsa_key, so on and forth, but not "/etc/hostname.pub" that Apache and nginx from ideal parallel world both looks up by default, or DHCP Option 666 "local certificate issuer IP address". I was just bored enough to watch someone setup Solaris on QEMU and that makes me think had SUNW existed today that's definitely how they would have done it. But no, it's in wherever path specified in /etc/apache2/sites-enabled/virtualhost12345.conf, which can be /etc/letsencrypt/whatever/subdirectory/hostname.pem or /usr/ssl/certs/dynamic_file_name.cer, and in many other cases it's whatever that `docker exec stout_kaltsit cat /ssl-cert-private.key` yields. No one even agrees on whether it sits in /etc or /usr or /var or somewhere mapped deep down. The whole TLS is just a hindrance that throws error that needs to be hastily cleared when encountered because the Web server stack is bunch of afterthoughts and that's what is showing.
- alanh 4y agoDo other Chromium browsers (Chromium, Brave, Edge, etc) have this same problem, and does this solution apply to them?