6 ms·

Chrome's SSL Bypass Cheatcode

64 points by thomascountz 1y ago

eugenekolo 1y ago
It's possible they changed it from "thisisunsafe" to the b64 version to avoid automatic scanners finding "unsafe" keyword usage.
_def 1y ago
I wonder if this is for quicker testing that happens recurringly (either automated or a poor soul doing it manually) where letting the phrase type by script is just easier than doing the 2 mouse clicks
almostgotcaught 1y ago
Jesus Christ thank god for this! Recently libgen ceased to be accessible because of this and I couldn't figure out any way to disable (on Firefox as well!). Bless you.
- chatmasta 1y ago
  Well hopefully the blog doesn’t get too much visibility or they’ll change the string again :) Sounds like the right place to look is the chromium commit log…
  - molticrystal 1y ago
    If an explicit keypress sequence becomes unavailable or changes, the script appears to call certificateErrorPageController.proceed(). So here is a bookmarklet that replicates this, add it to the URL field of a bookmark and click the bookmark to run it: javascript:(function(){if(window.certificateErrorPageController)window.certificateErrorPageController.proceed();})(); It should work as long as the proceed command remains functional and certificateErrorPageController hasn’t been renamed in non-developer builds.
- miloignis 1y ago
  For Firefox, I can normally click Advanced -> Accept Risk and Continue, which I think is about the perfect amount of friction.
pyrolistical 1y ago
Is this easier for screen readers to bypass?
Y_Y 1y ago
If I want to load some unencrypted data my browser better fucking let me do it. I don't mind if I have to give a secret handshake, but I have no sympathy for lusers who type "thisisunsafe" and then make it someone else's problem when their expectations of "safety" are violated.
- AnthonyMouse 1y ago
  We started off with SSL/TLS being used for payments systems and logins where its absence is very important to not ignore. Then we said we should use it for everything, which is good, but now it's showing up in different contexts. If it says the certificate for your bank is expired, you need to stop. If it says the certificate for the 10 year old public blog post that was linked by a 5 year old Reddit post as describing the solution to your problem, that should not matter, and you just want to read the non-secret contents of whatever is on that page regardless of whether the site's maintainer turned on HTTP to HTTPS redirects and then neglected to renew the certificate. And people understand this, and people are rightfully going to devise workarounds for the second case, and it's ridiculous to expect them to not.
  - seanwilson 1y ago
    > We started off with SSL/TLS being used for payments systems and logins ... If it says the certificate for your bank is expired, you need to stop. If it says the certificate for the 10 year old public blog post that was linked by a 5 year old Reddit post as describing the solution to your problem, that should not matter Non-HTTPS pages can be tampered with to inject any content into them e.g. into a blog post page, you could inject a login form ("sign in via Google to unlock this post"), a donation payment form ("donate for more content like this!"), or malware installers ("your browser is out of date, click to update" banner). I think pushing to protect non-tech savvy users makes sense here. I see even a lot of developers not understanding risks like the above, so it's a losing battle thinking non-techy users can be educated about it and be cautious enough.
    - snickerdoodle12 1y ago
sigio 1y ago
I've been using this a lot (when testing), but I wish firefox/mozilla had something equivalent, because with HSTS domains, it's hard to bypass cert issues in firefox.
- zzo38computer 1y ago
  In Firefox, I used a hex editor to modify the files so that it does not recognize the headers to set HSTS, and then I changed the file permissions so that the HSTS file cannot be modified, and then I disabled the HSTS preload list.
  - pabs3 1y ago
    Which files/modifications? I would like to be able to do this too.
giingyui 1y ago
Hey at least Chrome lets you can bypass SSL errors. Firefox makes it impossible to bypass SSL errors if the site uses HSTS. So much for the browser for power users.
- wasmperson 1y ago
  An example for anyone who hasn't seen this before: https://subdomain.preloaded-hsts.badssl.com/ https://subdomain.preloaded-hsts.badssl.com/
- jeroenhd 1y ago
  Firefox sticks to the spec, Chrome makes you type out base64 manually to ignore the spec. The TLS errors that aren't unbypassible by specification (i.e. HSTS, see https://datatracker.ietf.org/doc/html/rfc6797 https://datatracker.ietf.org/doc/html/rfc6797) can be bypassed on Firefox just fine. It's only the ones where the spec says bypassing the error shouldn't be possible where Firefox takes a hard stance. Chrome had to alter their bypass string several times because vendors documented the override rather than fixing their insecure crapware. It makes total sense to me that Firefox does the same.
  - Dylan16807 1y ago
    Being a user agent is more important than any spec.
  - giingyui 1y ago
    Software should do what I want it to, not stick to a spec.
    - giancarlostoro 1y ago
      Ah yes, software should leak everyone else's credentials to me because I want it to, forget keeping their information safe and secure, forget the GDRP.
      - yjftsjthsd-h 1y ago
tech234a 1y ago
I've found this useful periodically on desktop but I wonder how/if it would work on mobile if you don't have a physical keyboard attached.
pupppet 1y ago
Hey Chrome, give us a cheat code to permanently hide the close buttons on tabs.
neurostimulant 1y ago
They would change the code once it got popular enough so I bookmarked the source code to figure out the current code: https://chromium.googlesource.com/chromium/src/+/refs/heads/main/components/security_interstitials/core/browser/resources/interstitial_large.js#43 https://chromium.googlesource.com/chromium/src/+/refs/heads/...
tgsovlerkhgsel 1y ago
It really is unsafe though, even beyond what many who generally understand the web may realize. There are various ways (from caches to more obscure ones) in which loading a web site insecurely once, even if you aren't logged in at that time, can affect you much later when you think you are safe. If you ever do this, use a separate browser profile or incognito window. Don't use this just to e.g. get to a captive portal (use example.com or neverssl.com for that). You only need the "cheat code" if the site is using HSTS, which suggests it's the production web site of something that has a reason to try to be secure. If you're in a separate dev envrionment (different origin), you probably won't have HSTS set. For local development or browser-to-local-app communication, localhost counts as a secure origin even without HTTPS.

64 points by thomascountz 1y ago

It's possible they changed it from "thisisunsafe" to the b64 version to avoid automatic scanners finding "unsafe" keyword usage.

_def 1y ago

I wonder if this is for quicker testing that happens recurringly (either automated or a poor soul doing it manually) where letting the phrase type by script is just easier than doing the 2 mouse clicks

almostgotcaught 1y ago

Jesus Christ thank god for this! Recently libgen ceased to be accessible because of this and I couldn't figure out any way to disable (on Firefox as well!). Bless you.

chatmasta 1y ago
Well hopefully the blog doesn’t get too much visibility or they’ll change the string again :) Sounds like the right place to look is the chromium commit log…
- molticrystal 1y ago
  If an explicit keypress sequence becomes unavailable or changes, the script appears to call certificateErrorPageController.proceed(). So here is a bookmarklet that replicates this, add it to the URL field of a bookmark and click the bookmark to run it: javascript:(function(){if(window.certificateErrorPageController)window.certificateErrorPageController.proceed();})(); It should work as long as the proceed command remains functional and certificateErrorPageController hasn’t been renamed in non-developer builds.
miloignis 1y ago
For Firefox, I can normally click Advanced -> Accept Risk and Continue, which I think is about the perfect amount of friction.

pyrolistical 1y ago

Is this easier for screen readers to bypass?

Y_Y 1y ago

If I want to load some unencrypted data my browser better fucking let me do it. I don't mind if I have to give a secret handshake, but I have no sympathy for lusers who type "thisisunsafe" and then make it someone else's problem when their expectations of "safety" are violated.

AnthonyMouse 1y ago
We started off with SSL/TLS being used for payments systems and logins where its absence is very important to not ignore. Then we said we should use it for everything, which is good, but now it's showing up in different contexts. If it says the certificate for your bank is expired, you need to stop. If it says the certificate for the 10 year old public blog post that was linked by a 5 year old Reddit post as describing the solution to your problem, that should not matter, and you just want to read the non-secret contents of whatever is on that page regardless of whether the site's maintainer turned on HTTP to HTTPS redirects and then neglected to renew the certificate. And people understand this, and people are rightfully going to devise workarounds for the second case, and it's ridiculous to expect them to not.
- seanwilson 1y ago
  > We started off with SSL/TLS being used for payments systems and logins ... If it says the certificate for your bank is expired, you need to stop. If it says the certificate for the 10 year old public blog post that was linked by a 5 year old Reddit post as describing the solution to your problem, that should not matter Non-HTTPS pages can be tampered with to inject any content into them e.g. into a blog post page, you could inject a login form ("sign in via Google to unlock this post"), a donation payment form ("donate for more content like this!"), or malware installers ("your browser is out of date, click to update" banner). I think pushing to protect non-tech savvy users makes sense here. I see even a lot of developers not understanding risks like the above, so it's a losing battle thinking non-techy users can be educated about it and be cautious enough.
  - snickerdoodle12 1y ago

sigio 1y ago

I've been using this a lot (when testing), but I wish firefox/mozilla had something equivalent, because with HSTS domains, it's hard to bypass cert issues in firefox.

zzo38computer 1y ago
In Firefox, I used a hex editor to modify the files so that it does not recognize the headers to set HSTS, and then I changed the file permissions so that the HSTS file cannot be modified, and then I disabled the HSTS preload list.
- pabs3 1y ago
  Which files/modifications? I would like to be able to do this too.

giingyui 1y ago

Hey at least Chrome lets you can bypass SSL errors. Firefox makes it impossible to bypass SSL errors if the site uses HSTS. So much for the browser for power users.

wasmperson 1y ago
An example for anyone who hasn't seen this before: https://subdomain.preloaded-hsts.badssl.com/ https://subdomain.preloaded-hsts.badssl.com/
jeroenhd 1y ago
Firefox sticks to the spec, Chrome makes you type out base64 manually to ignore the spec. The TLS errors that aren't unbypassible by specification (i.e. HSTS, see https://datatracker.ietf.org/doc/html/rfc6797 https://datatracker.ietf.org/doc/html/rfc6797) can be bypassed on Firefox just fine. It's only the ones where the spec says bypassing the error shouldn't be possible where Firefox takes a hard stance. Chrome had to alter their bypass string several times because vendors documented the override rather than fixing their insecure crapware. It makes total sense to me that Firefox does the same.
- Dylan16807 1y ago
  Being a user agent is more important than any spec.
- giingyui 1y ago
  Software should do what I want it to, not stick to a spec.
  - giancarlostoro 1y ago
    Ah yes, software should leak everyone else's credentials to me because I want it to, forget keeping their information safe and secure, forget the GDRP.
    - yjftsjthsd-h 1y ago

tech234a 1y ago

I've found this useful periodically on desktop but I wonder how/if it would work on mobile if you don't have a physical keyboard attached.

pupppet 1y ago

Hey Chrome, give us a cheat code to permanently hide the close buttons on tabs.

neurostimulant 1y ago

They would change the code once it got popular enough so I bookmarked the source code to figure out the current code: https://chromium.googlesource.com/chromium/src/+/refs/heads/main/components/security_interstitials/core/browser/resources/interstitial_large.js#43 https://chromium.googlesource.com/chromium/src/+/refs/heads/...

tgsovlerkhgsel 1y ago

It really is unsafe though, even beyond what many who generally understand the web may realize. There are various ways (from caches to more obscure ones) in which loading a web site insecurely once, even if you aren't logged in at that time, can affect you much later when you think you are safe. If you ever do this, use a separate browser profile or incognito window. Don't use this just to e.g. get to a captive portal (use example.com or neverssl.com for that). You only need the "cheat code" if the site is using HSTS, which suggests it's the production web site of something that has a reason to try to be secure. If you're in a separate dev envrionment (different origin), you probably won't have HSTS set. For local development or browser-to-local-app communication, localhost counts as a secure origin even without HTTPS.