3 ms·
>HSTS is pointless without it No. If I click an http:// http:// link, I want that link to be upgraded automatically to https:// https:// if possible so that MI
by Thorrez 4y ago
>HSTS is pointless without it
No. If I click an http:// http:// link, I want that link to be upgraded automatically to https:// https:// if possible so that MITMs can't read or modify the request or response. I would still get that benefit if the browser made it easy to click through certificate warnings.
- lilyball 4y agoIf you're being MITM'd then you'll get a certificate warning. If it's easy to click through those then it's easy for MITMs to read or modify the request.
- Thorrez 4y agoI'm talking about my own safety. I won't click through it.
- lilyball 4y agoIf you won't click through it, then why do you want the browser to let you click through it?
- Thorrez 4y agoDid I say I want the browser to let me click through it? However, in general I think the browser preventing the user from doing something the user wants is a bit offputting. The browser is a "user agent". It should act on behalf of the user. If the user wants it to do something, it should do that. This case is tricky, because sometimes what the user really wants is not what the user is asking the user agent to do. It's an xy problem. I think Chrome's current behavior strikes a nice balance.