4 ms·
Its not really obviously documented but you can type “thisisunsafe” when you get the unpassable hsts screen and it will bypass.
by arealaccount 4y ago
Its not really obviously documented but you can type “thisisunsafe” when you get the unpassable hsts screen and it will bypass.
- ocdtrekkie 4y agoIs that a Chrome thing? I'm a Firefox user, generally. But my understanding is if the browser allows any sort of bypass it is not compliant with the spec.
- arealaccount 4y agoYes chrome only afaik. Im firefox as well, but sometimes I have to switch because the FF debugger will give up in certain cases.
- baisq 4y agoFirefox doesn't allow you to bypass it at all in recent versions. One of the many, many reasons not to use it. Less power to the user.
- tialaramex 4y agoYes, I have had this discussion with Google staff. Their opinion is that "thisisunsafe" is not really a bypass even though that's obviously exactly what it is and exactly how it is used. Historically there have been several phrases used, with changes once every few years, and the weak argument is that people who go to the bother of learning each new phrase, plus the fact the phrase tells you it's a bad idea (one of them literally) would bypass this anyway, but well... would they? Human psychology doesn't work that way. People get into the habit of typing whatever the magic phrase is and then they're astonished that it was a bad idea even though it just said so. You can't build effective security systems on such foundations.
- Wowfunhappy 4y agoThis is where I fundamentally disagree with a lot of security folks: if the the user is really, truly, absolutely sure that they want to shoot themselves in the foot, you should let them. It's their life to live.
- tialaramex 4y agoOnly Mother Nature gets to make rules nobody can disobey, so of course the user can shoot themselves in the foot. But, we needn't provide them with the gun, or the bullets.
- Spivak 4y agoThis is because we cry wolf too many times. When was the last time you cared about the SSH message REMOTE HOST IDENTIFICATION HAS CHANGED DANGER DANGER SPOOKY SCARY? I bet never because 100 times out of 100 that message is because of a misconfiguration on the remote host or someone termed the instance and uses the autogenerated keys. Same with TLS errors. I have never once encountered a single instance of someone trying to intercept my connection but I’ve encountered hundreds of misconfigured but otherwise perfectly functional servers if you just ignore the errors. You can’t really blame users when you hide literally all the details that would allow them to make an informed decision about whether they should hit “It’s Fine False Alarm” or “Oh Shit Got Em” and then be surprised when people hit the false alarm button without thinking when it’s always a damn false alarm. We would do so much better if we had screens like, “Hey the cert the server sent is otherwise valid but expired 5 minutes ago, is that cool?” or “The server sent a certificate for bloop.domain” but you connected to “blorp.domain” with options like “Seems Sus”, “My b it was a typo” and “Damn, autocorrect gottem.” Like we have absolutely zero reasonable sense of security and risk as anything other than perfectly secure and defcon 69.
- randyrand 4y agoI can also take a picture of whatever sensitive information is on the screen / in the console / dev tools / and send it to hackers for fun. Not sure how your security model will handle that.
- jeroenhd 4y agoFirefox used to have bypass functionality but I don't think it has it anymore since the TLS error pages were redesigned.