5 ms·

No, most browsers do allow configuring this, but it’s no longer a simple “click through a warning”. Maybe that means the death of the personal website run by so

No, most browsers do allow configuring this, but it’s no longer a simple “click through a warning”. Maybe that means the death of the personal website run by someone who refuses to get a certificate which chains to something publicly trusted and compliant with CA/B baselines, but I’d argue that’s actually a good thing — we would obviously disagree on this but I view this as removing easy ways for end users to do insecure things.

superkuh 4y ago
>no, most browsers do allow configuring this, Really? Are you sure about that? I'd love to believe you as it'd mean there's been progress on this front but the last time I checked it required compile time flags in Chrome and Firefox. The problem is that this is a function of the libraries these browsers use, it's not an option that is within the browser itself. >removing easy ways for end users to do insecure things. That's a legit pov as long as you think about browsers as in the for-profit way: as insecure virtual machines for customers to run your untrusted third party code. And that's certainly the zeitgeist. But that's not what the web is to many human people. The web of documents still exists despite the last decade of the web just being a mechanism to distribute JS applications. I know that the for-profit point of view doesn't care about the web of documents (not profitable) but that doesn't make their use case the only use case. All you have to do to make accepting self-signed certs as secure (or more secure) than the "normal" web is to turn off automatic execution of untrusted code sent to you. I'd wager that a good fraction of the HN userbase already does this with their NoScript or uBlock or whatever anti-javascript protection extensions.
- jefftk 4y ago
  The ways in which MITM attacks are dangerous are not limited to sites running JavaScript. The big one is that MITM can change what you see on sites. I should be able to trust that everything I read on superkuh.com is your writing, but today anyone operating a network node between my browser and your server can make arbitrary edits to your work.
  - superkuh 4y ago
    I agree. But this doesn't matter for the vast majority of websites (ie, non-commercial, non-institutional, personal websites). You can change it so it says or shows whatever and it's not going to hurt anyone. Just like requiring everyone to wear a level 3 bullet proof vest while making dinner will make the process safer, so will requiring CA based certs. And in this particular exact scenario, you can use my .onion site for superkuh.com to verify the end-point identity if you're really worried that someone might change the text. A system that works without CAs.
    - afiori 4y ago
      It matters if you have concerns about the experience users have on your site. Among other things a MitM can: - insert ads in your page - run miners on your user's browser - change links or redirect the page (likely to an CA-signed malware site) - insert malware in downloadable scripts on your site (http://superkuh.com/TkTTS.pl http://superkuh.com/TkTTS.pl)
- nixgeek 4y ago
  On Windows and using Chrome as an example you’d set: Software\Policies\Google\Chrome,SSLErrorOverrideAllowed,REG_DWORD,1
johannes1234321 4y ago
For public facing things this is likely good. For my own home use it is quite an annoyance. The thing I wonder: will this prevent Internet of Sh*t devices to spread or will they become fully reliant on cloud, thus dependent on the vendor (as the customer's browser won't talk to it)

superkuh 4y ago

>no, most browsers do allow configuring this, Really? Are you sure about that? I'd love to believe you as it'd mean there's been progress on this front but the last time I checked it required compile time flags in Chrome and Firefox. The problem is that this is a function of the libraries these browsers use, it's not an option that is within the browser itself. >removing easy ways for end users to do insecure things. That's a legit pov as long as you think about browsers as in the for-profit way: as insecure virtual machines for customers to run your untrusted third party code. And that's certainly the zeitgeist. But that's not what the web is to many human people. The web of documents still exists despite the last decade of the web just being a mechanism to distribute JS applications. I know that the for-profit point of view doesn't care about the web of documents (not profitable) but that doesn't make their use case the only use case. All you have to do to make accepting self-signed certs as secure (or more secure) than the "normal" web is to turn off automatic execution of untrusted code sent to you. I'd wager that a good fraction of the HN userbase already does this with their NoScript or uBlock or whatever anti-javascript protection extensions.

jefftk 4y ago
The ways in which MITM attacks are dangerous are not limited to sites running JavaScript. The big one is that MITM can change what you see on sites. I should be able to trust that everything I read on superkuh.com is your writing, but today anyone operating a network node between my browser and your server can make arbitrary edits to your work.
- superkuh 4y ago
  I agree. But this doesn't matter for the vast majority of websites (ie, non-commercial, non-institutional, personal websites). You can change it so it says or shows whatever and it's not going to hurt anyone. Just like requiring everyone to wear a level 3 bullet proof vest while making dinner will make the process safer, so will requiring CA based certs. And in this particular exact scenario, you can use my .onion site for superkuh.com to verify the end-point identity if you're really worried that someone might change the text. A system that works without CAs.
  - afiori 4y ago
    It matters if you have concerns about the experience users have on your site. Among other things a MitM can: - insert ads in your page - run miners on your user's browser - change links or redirect the page (likely to an CA-signed malware site) - insert malware in downloadable scripts on your site (http://superkuh.com/TkTTS.pl http://superkuh.com/TkTTS.pl)
nixgeek 4y ago
On Windows and using Chrome as an example you’d set: Software\Policies\Google\Chrome,SSLErrorOverrideAllowed,REG_DWORD,1

johannes1234321 4y ago

For public facing things this is likely good. For my own home use it is quite an annoyance. The thing I wonder: will this prevent Internet of Sh*t devices to spread or will they become fully reliant on cloud, thus dependent on the vendor (as the customer's browser won't talk to it)