8 ms·
Neverssl Uses SSL
- woodruffw 3y agoThey missed an opportunity to claim that they only support TLS, not SSL. Unless they're also accepting SSLv3 connections.
- jwilk 3y agoLooks like they don't: $ openssl s_client -ssl3 -connect neverssl.com:443 CONNECTED(00000003) 140453876520616:error:1409442E:SSL routines:SSL3_READ_BYTES:tlsv1 alert protocol version:s3_pkt.c:1315:SSL alert number 70 140453876520616:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:637:
- thangngoc89 3y agoI usually use http://captive.apple.com http://captive.apple.com for the same functionality of NeverSSL and if you're using any Apple devices, that is the address iOS/iPadOS/macOS would use for wifi login
- cuteboy19 3y agoI used to use detectportal.firefox.com but now it downloads some bin file for whatever reason
- EwanToo 3y agoSince November 2021, not sure this is news..
- mh- 3y agoTrue, headline deserves a (2021). But, it was news to me yesterday when it came up in a comment thread here.
- ChrisMarshallNY 3y ago> some browsers and sites automatically use https even when you don't type that in. My experience is that many of them do. I think mine do, by default.
- karmakaze 3y agoThere's a number of rules around using https first/only. I recall that all .app domains only use https as well as any domain using HSTS. - https://www.eff.org/https-everywhere/set-https-default-your-browser https://www.eff.org/https-everywhere/set-https-default-your-...
- aftbit 3y agoWhat's the point of this site? Why not just use http://example.com http://example.com?
- happytoexplain 3y agoWhat are you referring to? It sounds like you're confused why more than one person made a solution to a problem. There's also captive.apple.com, among others.
- rimunroe 3y agoAre there other domain names reserved by IANA for the same purpose? I trust the people in charge of domain names to not change their minds on something like this more than I would a company (such as Apple).
- paxys 3y agoWhat is the purpose of http://example.com http://example.com? Why not just use http://neverssl.com http://neverssl.com?
- tomstockmail 3y agoExample.com is reserved by IANA and should be reliable to exist for a long time. From the "more information" link: >As described in RFC 2606 and RFC 6761, a number of domains such as example.com and example.org are maintained for documentation purposes.
- quasiuna 3y agoIs this a joke? Seems to be the most bizarre example of a pivot for a service with such a straightforward purpose. It’s like a vegan meat company also selling pork sausage just in case they miss out on some passing carnivores.
- yardstick 3y agoDid you read the tweet? They had to add this because browsers now often auto append https:// https:// to manually typed domain entries anyway. So it loads on https, then redirects to a http-only subdomain. This way you can still find any captive portals needing you to login/accept T&Cs/etc. Which is what neverssl’s core purpose actually is.
- bityard 3y agoUnless I'm missing something embarrassingly obvious, redirecting HTTPS->HTTP doesn't help those use cases at all.
- jsmith45 3y agoWhen behind a captive portal, you need to load some page over http to allow the device MITM you. Nice devices will have built in captive portal checking, but not all devices are built nicely. On some devices typing “neverssl.com” will try to resolve https://neverssl.com https://neverssl.com without any form of http fallback. It may be actually pretty difficult to type :// on some devices too. On these devices, if you ever visit “neverssl.com” when not behind a captive portal, you will get a a catchable redirect to http. Then the next time you are behind a captive portal, if you type “neverssl.com” the browser resolve it to https like always, but will remember the cached redirect, and try to load the http version, letting you land at the captive portal page.
- iforgotpassword 3y agoSooo, you're behind a captive portal which blocks internet access. So you access an https website on the internet that will redirect you to http. Wat.
- saila 3y agoThey support SSL because some browsers force https, but they then force a redirect to a non-SSL page. Seems reasonable. I think I may be missing the point of this being posted on HN. Does it cause issues in certain workflows or something?
- paxys 3y agoNope, people are just looking for their daily dose of outrage.
- rubatuga 3y agoWhich browsers force https when you type in http:// http:// before the domain?
- Linux-Fan 3y agoFirefox 102.10.0esr seems to do this here. I type into the address bar: `http://example.com http://example.com` and it corrects it to the HTTPS version. Even when I try to change the URL back to the `http:// http://` it goes to the HTTPS version. When I try the same with curl as in `curl -v http://example.com http://example.com` I can see the HTTP traffic coming through correctly i.e. the site still supports HTTP. Note that I have configured "Don't enable HTTPS-Only Mode" in the Firefox settings. I use some addons although none to specifically redirect my requests to HTTPS...
- cuteboy19 3y agoIs it possible that example com is redirecting you
- sohkamyung 3y agoI am using Firefox Nightly 114.0a1, with "Don't enable HTTPS-Only Mode" enabled, and a visit to http://example.com http://example.com works as expected (a GET from http). Enable the web developer tools (Menu->More Tools->Web Developer Tools), visit the site again, and see if it is directly visiting the site or getting a redirect.
- jonas-w 3y agoRelated: https://news.ycombinator.com/item?id=35792078 https://news.ycombinator.com/item?id=35792078
- anotherhue 3y agoI like http://example.com http://example.com as it's IANA owned (or maybe ICANN) so more stable than most hobbyist versions. https://en.wikipedia.org/wiki/Example.com https://en.wikipedia.org/wiki/Example.com
- rubatuga 3y agoWhen I was trying to use the site a few weeks ago, port 80 wasn't working at all. Just port 443/HTTPS. So not only does it fail at never using ssl, but it also sometimes fails at doing HTTP.