5 ms·

I absolutely care. About how absolutely cursed HSTS is as a concept. It's basically the EME of TLS. The idea that they put it right in the specification that b

I absolutely care. About how absolutely cursed HSTS is as a concept. It's basically the EME of TLS. The idea that they put it right in the specification that browsers were prohibited from allowing users to bypass it, even if they know what they're doing, fully moved browsers out of the "user agent" category.

dinosaurdynasty 4y ago
EME of TLS? They put that requirement in there because HSTS is pointless without it. The website is literally saying "we will always (w/ expiration) have valid TLS, if we don't that's a problem". Allowing users to bypass it allows criminals to go "oh we're having problems with the cert, just type 'badidea' and click yes to continue to be hacked".
- ocdtrekkie 4y ago
  A user agent must work for the user, not the server. Obeying the server over the user's intent is malicious design. And if that makes it pointless, then just remove it entirely. Believe it or not, I've never seen a cert error in the wild that wasn't an expiration of a valid cert or a misconfiguration. The boogeyman of MITM attacks which PKI certs protect from is used to justify a lot of terrible changes to the web that aren't reflected by reality: In most cases they're just going to hack the real server and serve malicious content from your valid certificate anyways. Or they'll trick someone into giving their credentials to bonkofamerica.com because people are easy to fool. Why MITM Amazon when people will happily treat an order email sent from a Gmail account as legitimate?
  - toomim 4y ago
    Preach! Power to the User!
  - notriddle 4y ago
    > I've never seen a cert error in the wild that wasn't an expiration of a valid cert or a misconfiguration. I have. Usually caused by a captive portal. > The boogeyman of MITM attacks which PKI certs protect from is used to justify a lot of terrible changes to the web that aren't reflected by reality. The move to use HTTPS everywhere was started in response to packet sniffing tools like Firesheep. That’s not a boogeyman; it’s a proof of concept that works in realistic scenarios. > Why MITM Amazon when people will happily treat an order email sent from a Gmail account as legitimate? So what? How about solving both problems?
    - ocdtrekkie 4y ago
      Captive portals aren't malicious. They're arguably helpful. But I've never seen a captive portal using fake certificates either.
      - justsomehnguy 4y ago
        > But I've never seen a captive portal using fake certificates either. I never seen a captive portal using a valid certificate either. Not like I saw many captive portals (last time was like... 2018?) but still.
      - notriddle 4y ago
        Whether they’re malicious or not, I don’t want to send them the session cookie for an unrelated website.
        saurik 4y ago
        So scope cookies to the SSL certificate instead of the domain name, or simply offer to clear them for a domain whenever you bypass the HSTS on one.
        duskwuff 4y ago
        > So scope cookies to the SSL certificate And invalidate every user's session whenever the server's certificate is renewed??
      - Thorrez 4y ago
        >using fake certificates What's the definition of a fake certificate? Self signed? Signed by a real CA, but for a different domain (the captive portal operator's generally)?
  - Thorrez 4y ago
    >I've never seen a cert error in the wild that wasn't an expiration of a valid cert or a misconfiguration. Here's one example: https://www.engadget.com/2018-04-25-hackers-dns-phishing-scam-cryptocurrency-myetherwallet.html https://www.engadget.com/2018-04-25-hackers-dns-phishing-sca...
- Thorrez 4y ago
  >HSTS is pointless without it No. If I click an http:// http:// link, I want that link to be upgraded automatically to https:// https:// if possible so that MITMs can't read or modify the request or response. I would still get that benefit if the browser made it easy to click through certificate warnings.
  - lilyball 4y ago
    If you're being MITM'd then you'll get a certificate warning. If it's easy to click through those then it's easy for MITMs to read or modify the request.
    - Thorrez 4y ago
      I'm talking about my own safety. I won't click through it.
      - lilyball 4y ago
        If you won't click through it, then why do you want the browser to let you click through it?
        Thorrez 4y ago
        Did I say I want the browser to let me click through it? However, in general I think the browser preventing the user from doing something the user wants is a bit offputting. The browser is a "user agent". It should act on behalf of the user. If the user wants it to do something, it should do that. This case is tricky, because sometimes what the user really wants is not what the user is asking the user agent to do. It's an xy problem. I think Chrome's current behavior strikes a nice balance.
- Thorrez 4y ago
  >Allowing users to bypass it allows criminals to go "oh we're having problems with the cert, just type 'badidea' and click yes to continue to be hacked". Are you using this as an example of how HSTS is helping users now? Because Chrome allows you to type 'thisisunsafe' and you'll get through the warning, regardless of HSTS.
zzo38computer 4y ago
I also dislike HSTS. I modified the .so file so that it does not recognize the Strict-Transport-Security header. (There are many other features that are also bad, but HSTS is especially bad.) The browser MUST allow the end user to override EVERYTHING (and assume that you know what you are doing, instead of trying to do things for you differently than what you did), and then it will be good.
arealaccount 4y ago
Its not really obviously documented but you can type “thisisunsafe” when you get the unpassable hsts screen and it will bypass.
- ocdtrekkie 4y ago
  Is that a Chrome thing? I'm a Firefox user, generally. But my understanding is if the browser allows any sort of bypass it is not compliant with the spec.
  - arealaccount 4y ago
    Yes chrome only afaik. Im firefox as well, but sometimes I have to switch because the FF debugger will give up in certain cases.
  - baisq 4y ago
    Firefox doesn't allow you to bypass it at all in recent versions. One of the many, many reasons not to use it. Less power to the user.
  - tialaramex 4y ago
    Yes, I have had this discussion with Google staff. Their opinion is that "thisisunsafe" is not really a bypass even though that's obviously exactly what it is and exactly how it is used. Historically there have been several phrases used, with changes once every few years, and the weak argument is that people who go to the bother of learning each new phrase, plus the fact the phrase tells you it's a bad idea (one of them literally) would bypass this anyway, but well... would they? Human psychology doesn't work that way. People get into the habit of typing whatever the magic phrase is and then they're astonished that it was a bad idea even though it just said so. You can't build effective security systems on such foundations.
    - Wowfunhappy 4y ago
      This is where I fundamentally disagree with a lot of security folks: if the the user is really, truly, absolutely sure that they want to shoot themselves in the foot, you should let them. It's their life to live.
Thorrez 4y ago
HSTS is weird. It does 2 completely separate things: 1. Automatically redirect from http:// http:// to https:// https:// . 2. Make it difficult to bypass the certificate warning screen. 1 I think is very good. 2 is questionable.
- ocdtrekkie 4y ago
  Yeah, I have no issue with a site indicating it only wants to talk over HTTPS. But to disable my ability to proceed even if I know what's going on with the site in question is constantly irritating.

dinosaurdynasty 4y ago

EME of TLS? They put that requirement in there because HSTS is pointless without it. The website is literally saying "we will always (w/ expiration) have valid TLS, if we don't that's a problem". Allowing users to bypass it allows criminals to go "oh we're having problems with the cert, just type 'badidea' and click yes to continue to be hacked".

ocdtrekkie 4y ago
A user agent must work for the user, not the server. Obeying the server over the user's intent is malicious design. And if that makes it pointless, then just remove it entirely. Believe it or not, I've never seen a cert error in the wild that wasn't an expiration of a valid cert or a misconfiguration. The boogeyman of MITM attacks which PKI certs protect from is used to justify a lot of terrible changes to the web that aren't reflected by reality: In most cases they're just going to hack the real server and serve malicious content from your valid certificate anyways. Or they'll trick someone into giving their credentials to bonkofamerica.com because people are easy to fool. Why MITM Amazon when people will happily treat an order email sent from a Gmail account as legitimate?
- toomim 4y ago
  Preach! Power to the User!
- notriddle 4y ago
  > I've never seen a cert error in the wild that wasn't an expiration of a valid cert or a misconfiguration. I have. Usually caused by a captive portal. > The boogeyman of MITM attacks which PKI certs protect from is used to justify a lot of terrible changes to the web that aren't reflected by reality. The move to use HTTPS everywhere was started in response to packet sniffing tools like Firesheep. That’s not a boogeyman; it’s a proof of concept that works in realistic scenarios. > Why MITM Amazon when people will happily treat an order email sent from a Gmail account as legitimate? So what? How about solving both problems?
  - ocdtrekkie 4y ago
    Captive portals aren't malicious. They're arguably helpful. But I've never seen a captive portal using fake certificates either.
    - justsomehnguy 4y ago
      > But I've never seen a captive portal using fake certificates either. I never seen a captive portal using a valid certificate either. Not like I saw many captive portals (last time was like... 2018?) but still.
    - notriddle 4y ago
      Whether they’re malicious or not, I don’t want to send them the session cookie for an unrelated website.
      - saurik 4y ago
        So scope cookies to the SSL certificate instead of the domain name, or simply offer to clear them for a domain whenever you bypass the HSTS on one.
        duskwuff 4y ago
        > So scope cookies to the SSL certificate And invalidate every user's session whenever the server's certificate is renewed??
    - Thorrez 4y ago
      >using fake certificates What's the definition of a fake certificate? Self signed? Signed by a real CA, but for a different domain (the captive portal operator's generally)?
- Thorrez 4y ago
  >I've never seen a cert error in the wild that wasn't an expiration of a valid cert or a misconfiguration. Here's one example: https://www.engadget.com/2018-04-25-hackers-dns-phishing-scam-cryptocurrency-myetherwallet.html https://www.engadget.com/2018-04-25-hackers-dns-phishing-sca...
Thorrez 4y ago
>HSTS is pointless without it No. If I click an http:// http:// link, I want that link to be upgraded automatically to https:// https:// if possible so that MITMs can't read or modify the request or response. I would still get that benefit if the browser made it easy to click through certificate warnings.
- lilyball 4y ago
  If you're being MITM'd then you'll get a certificate warning. If it's easy to click through those then it's easy for MITMs to read or modify the request.
  - Thorrez 4y ago
    I'm talking about my own safety. I won't click through it.
    - lilyball 4y ago
      If you won't click through it, then why do you want the browser to let you click through it?
      - Thorrez 4y ago
        Did I say I want the browser to let me click through it? However, in general I think the browser preventing the user from doing something the user wants is a bit offputting. The browser is a "user agent". It should act on behalf of the user. If the user wants it to do something, it should do that. This case is tricky, because sometimes what the user really wants is not what the user is asking the user agent to do. It's an xy problem. I think Chrome's current behavior strikes a nice balance.
Thorrez 4y ago
>Allowing users to bypass it allows criminals to go "oh we're having problems with the cert, just type 'badidea' and click yes to continue to be hacked". Are you using this as an example of how HSTS is helping users now? Because Chrome allows you to type 'thisisunsafe' and you'll get through the warning, regardless of HSTS.

zzo38computer 4y ago

I also dislike HSTS. I modified the .so file so that it does not recognize the Strict-Transport-Security header. (There are many other features that are also bad, but HSTS is especially bad.) The browser MUST allow the end user to override EVERYTHING (and assume that you know what you are doing, instead of trying to do things for you differently than what you did), and then it will be good.

arealaccount 4y ago

Its not really obviously documented but you can type “thisisunsafe” when you get the unpassable hsts screen and it will bypass.

ocdtrekkie 4y ago
Is that a Chrome thing? I'm a Firefox user, generally. But my understanding is if the browser allows any sort of bypass it is not compliant with the spec.
- arealaccount 4y ago
  Yes chrome only afaik. Im firefox as well, but sometimes I have to switch because the FF debugger will give up in certain cases.
- baisq 4y ago
  Firefox doesn't allow you to bypass it at all in recent versions. One of the many, many reasons not to use it. Less power to the user.
- tialaramex 4y ago
  Yes, I have had this discussion with Google staff. Their opinion is that "thisisunsafe" is not really a bypass even though that's obviously exactly what it is and exactly how it is used. Historically there have been several phrases used, with changes once every few years, and the weak argument is that people who go to the bother of learning each new phrase, plus the fact the phrase tells you it's a bad idea (one of them literally) would bypass this anyway, but well... would they? Human psychology doesn't work that way. People get into the habit of typing whatever the magic phrase is and then they're astonished that it was a bad idea even though it just said so. You can't build effective security systems on such foundations.
  - Wowfunhappy 4y ago
    This is where I fundamentally disagree with a lot of security folks: if the the user is really, truly, absolutely sure that they want to shoot themselves in the foot, you should let them. It's their life to live.

Thorrez 4y ago

HSTS is weird. It does 2 completely separate things: 1. Automatically redirect from http:// http:// to https:// https:// . 2. Make it difficult to bypass the certificate warning screen. 1 I think is very good. 2 is questionable.

ocdtrekkie 4y ago
Yeah, I have no issue with a site indicating it only wants to talk over HTTPS. But to disable my ability to proceed even if I know what's going on with the site in question is constantly irritating.