5 ms·

Please for the love of god, if you're working at google and read this: Add a deeply set option to FORCIBLY enable that button in all situations where it might a

Please for the love of god, if you're working at google and read this: Add a deeply set option to FORCIBLY enable that button in all situations where it might appear. We sometimes have certificate issues with our proxy server at my workplace and it makes Chrome practically unusable when they happen. I know what I'm doing. I'll reset the option when the underlying issue is resolved, and overall it's a great feature for the browser, but I need to have the ability to be responsible for myself.

Flimm 14y ago
Or fix the certificate issues. Don't train the staff to be blind to security warnings.
- jarek 14y ago
  How exactly does "I know what I'm doing. I'll reset the option when the underlying issue is resolved, and overall it's a great feature for the browser, but I need to have the ability to be responsible for myself." become "train the staff to be blind to security warnings"?
  - Flimm 14y ago
    If you know what you're doing, you'd know how to get around this limitation, with the --ignore-certificate-errors option for example. Any knowledgeable front-end or back-end developer would know how to find this out by doing a Google search. As long as you don't train the rest of the staff to do the same, that's fine. Now, why isn't the IT department fixing this security and usability problem?
  - tptacek 14y ago
    If you know what you're doing, get the CA=YES cert from your proxy and install it in your browser.
    - DannoHung 14y ago
      The cert itself was broken in the most recent case.
agl 14y ago
The bypass button only disappears for HSTS sites. Do you have a proxy server that's intercepting these connections and has a broken certificate? You can disable all certificate checking with --ignore-certificate-errors but it is as bad as it sounds. Rather, to correctly support MITM proxies you should install their CA certificate locally.
- DannoHung 14y ago
  I suppose I can use that the next time it happens, but that's a bit more overkill in terms of disabling warnings than I'm looking for :/
  - tptacek 14y ago
    Starting Chrome with a flag is more overkill than adding a whole feature to Chrome to allow users to ignore SSL security?
flatline3 14y ago
> We sometimes have certificate issues with our proxy server at my workplace ... This is the problem. > ... and it makes Chrome practically unusable when they happen This is not the problem.
- konstruktor 14y ago
  The latter is just as bad. Opinionated software, i.e. making things that are usually a bad choice hard, is a good thing. Making possible things deliberately impossible for the victims of other people's bad decision making is arrogant. So some idiot CIO chose to make https mandatory but their staff can't get it configured properly. I am sure the non-IT user's boss will be happy that, instead of, say, closing that one important deal, the user waits until the https issue is resolved. What a way to drive IE out of the enterprise...
  - tptacek 14y ago
    Random enterprises will always be breaking some part of the HTTP stack. It's not reasonable to degrade everyone's security, even the majority of people who don't have unnecessary breakage inflicted on them, just to accommodate those enterprises. There is a clean solution to this problem: the proxies should serve as just-in-time CAs for the traffic they proxy. The big proxy products all do that. This simply isn't Chrome's problem.
    - konstruktor 14y ago
      Do you realize that it's not the abstract concept of an enterprise using a browser, but a human being? Which, usually, is not the person administering the server. I'm all for nudging people to change their own behaviour to the better, but this is driving your principles home on the back of the user. Considering your use of the word "breakage": DannoHung is talking about a button that is actively being disabled in certain situations, not something bad being enabled. This is extra code in a security critical part of the browser. Thus, we can assume that there were meetings that discussed this "feature" and its implications, the actual coding, code reviews and QA, adding up to quite a bit of opportunity cost. That begs the question: Would this time have been better spent on something that adds more security? Disabling manual overrides may seem like a good idea, but it can go horribly wrong. http://en.wikipedia.org/wiki/Lufthansa_Flight_2904 http://en.wikipedia.org/wiki/Lufthansa_Flight_2904
tptacek 14y ago
It's very straightforward for a proxy to have its own CA=YES certificate and mint/sign certs for every HTTPS site the proxy sees on the fly. If you have a corporate proxy that is intercepting HTTPS traffic, that is what it should be doing. Then, the proxy makes its certificate available to users, you download it, and add it to your CA certs via the UI that browsers provide for that; HTTPS magically appears to work again.
- dekz 14y ago
  So the proxy server acts as a forced man in the middle? This has to be one of the most atrocious things I have ever experienced. Forcing a man in the middle is insane especially in a large company where there may well be a lack in competency. HTTPS shouldn't magically appear to 'work' again, considering it is completely broken when a forced mitm is introduced.
  - tptacek 14y ago
    Are you arguing with me, or with reality? I can't tell, because the system I described is how corporate proxies work pretty much everywhere. If you want privacy against the administrators of your employer, don't use your employer's network to do things that need privacy.
    - dekz 14y ago
      I don't see how my comment may be interpreted as starting an argument. I was simply replying on your comment on HTTPS just 'work'ing once you ignore the man in the middle attack. It's not privacy from an employer that is the underlying issue. It is the practice itself which should be frowned upon. People didn't spend their time trying to come up with the ability to have secure communications from point A to point B just to have someone come in and break it. The problem isn't necessarily what the employer sees, it's what the might employer keep around.
      - tptacek 14y ago
        Enterprises are making a policy decision to take advantage of the Internet security model from the border of their network outward, but to take responsibility for IP security inside their network. That is a reasonable policy decision. But even if reasonable people could disagree about that policy decision: the reality is that people operating large corporate networks require the ability to control SSL/TLS sessions; for instance, there are whole industry verticals where accessing a private email server not controlled by your employer is grounds for automatic termination, because regulations require them to track and archive email messages. Finally, and I'm repeating myself: I am describing the reality of most Fortune-500 enterprise networks. In most corporate networks, you cannot simply talk from your desktop out to the Internet; you are required to use a proxy. You're also almost certainly on an 10/8 IP address.
harshreality 14y ago
You can remove HSTS on a per-domain basis using chrome://net-internals/#hsts Are you looking for something else?
- justinschuh 14y ago
  You can't remove the preloaded ones, which is really how it should be.

Flimm 14y ago

Or fix the certificate issues. Don't train the staff to be blind to security warnings.

jarek 14y ago
How exactly does "I know what I'm doing. I'll reset the option when the underlying issue is resolved, and overall it's a great feature for the browser, but I need to have the ability to be responsible for myself." become "train the staff to be blind to security warnings"?
- Flimm 14y ago
  If you know what you're doing, you'd know how to get around this limitation, with the --ignore-certificate-errors option for example. Any knowledgeable front-end or back-end developer would know how to find this out by doing a Google search. As long as you don't train the rest of the staff to do the same, that's fine. Now, why isn't the IT department fixing this security and usability problem?
- tptacek 14y ago
  If you know what you're doing, get the CA=YES cert from your proxy and install it in your browser.
  - DannoHung 14y ago
    The cert itself was broken in the most recent case.

agl 14y ago

The bypass button only disappears for HSTS sites. Do you have a proxy server that's intercepting these connections and has a broken certificate? You can disable all certificate checking with --ignore-certificate-errors but it is as bad as it sounds. Rather, to correctly support MITM proxies you should install their CA certificate locally.

DannoHung 14y ago
I suppose I can use that the next time it happens, but that's a bit more overkill in terms of disabling warnings than I'm looking for :/
- tptacek 14y ago
  Starting Chrome with a flag is more overkill than adding a whole feature to Chrome to allow users to ignore SSL security?

flatline3 14y ago

> We sometimes have certificate issues with our proxy server at my workplace ... This is the problem. > ... and it makes Chrome practically unusable when they happen This is not the problem.

konstruktor 14y ago
The latter is just as bad. Opinionated software, i.e. making things that are usually a bad choice hard, is a good thing. Making possible things deliberately impossible for the victims of other people's bad decision making is arrogant. So some idiot CIO chose to make https mandatory but their staff can't get it configured properly. I am sure the non-IT user's boss will be happy that, instead of, say, closing that one important deal, the user waits until the https issue is resolved. What a way to drive IE out of the enterprise...
- tptacek 14y ago
  Random enterprises will always be breaking some part of the HTTP stack. It's not reasonable to degrade everyone's security, even the majority of people who don't have unnecessary breakage inflicted on them, just to accommodate those enterprises. There is a clean solution to this problem: the proxies should serve as just-in-time CAs for the traffic they proxy. The big proxy products all do that. This simply isn't Chrome's problem.
  - konstruktor 14y ago
    Do you realize that it's not the abstract concept of an enterprise using a browser, but a human being? Which, usually, is not the person administering the server. I'm all for nudging people to change their own behaviour to the better, but this is driving your principles home on the back of the user. Considering your use of the word "breakage": DannoHung is talking about a button that is actively being disabled in certain situations, not something bad being enabled. This is extra code in a security critical part of the browser. Thus, we can assume that there were meetings that discussed this "feature" and its implications, the actual coding, code reviews and QA, adding up to quite a bit of opportunity cost. That begs the question: Would this time have been better spent on something that adds more security? Disabling manual overrides may seem like a good idea, but it can go horribly wrong. http://en.wikipedia.org/wiki/Lufthansa_Flight_2904 http://en.wikipedia.org/wiki/Lufthansa_Flight_2904

tptacek 14y ago

It's very straightforward for a proxy to have its own CA=YES certificate and mint/sign certs for every HTTPS site the proxy sees on the fly. If you have a corporate proxy that is intercepting HTTPS traffic, that is what it should be doing. Then, the proxy makes its certificate available to users, you download it, and add it to your CA certs via the UI that browsers provide for that; HTTPS magically appears to work again.

dekz 14y ago
So the proxy server acts as a forced man in the middle? This has to be one of the most atrocious things I have ever experienced. Forcing a man in the middle is insane especially in a large company where there may well be a lack in competency. HTTPS shouldn't magically appear to 'work' again, considering it is completely broken when a forced mitm is introduced.
- tptacek 14y ago
  Are you arguing with me, or with reality? I can't tell, because the system I described is how corporate proxies work pretty much everywhere. If you want privacy against the administrators of your employer, don't use your employer's network to do things that need privacy.
  - dekz 14y ago
    I don't see how my comment may be interpreted as starting an argument. I was simply replying on your comment on HTTPS just 'work'ing once you ignore the man in the middle attack. It's not privacy from an employer that is the underlying issue. It is the practice itself which should be frowned upon. People didn't spend their time trying to come up with the ability to have secure communications from point A to point B just to have someone come in and break it. The problem isn't necessarily what the employer sees, it's what the might employer keep around.
    - tptacek 14y ago
      Enterprises are making a policy decision to take advantage of the Internet security model from the border of their network outward, but to take responsibility for IP security inside their network. That is a reasonable policy decision. But even if reasonable people could disagree about that policy decision: the reality is that people operating large corporate networks require the ability to control SSL/TLS sessions; for instance, there are whole industry verticals where accessing a private email server not controlled by your employer is grounds for automatic termination, because regulations require them to track and archive email messages. Finally, and I'm repeating myself: I am describing the reality of most Fortune-500 enterprise networks. In most corporate networks, you cannot simply talk from your desktop out to the Internet; you are required to use a proxy. You're also almost certainly on an 10/8 IP address.

harshreality 14y ago

You can remove HSTS on a per-domain basis using chrome://net-internals/#hsts Are you looking for something else?

justinschuh 14y ago
You can't remove the preloaded ones, which is really how it should be.