6 ms·

If I want to load some unencrypted data my browser better fucking let me do it. I don't mind if I have to give a secret handshake, but I have no sympathy for lu

by Y_Y 1y ago

If I want to load some unencrypted data my browser better fucking let me do it. I don't mind if I have to give a secret handshake, but I have no sympathy for lusers who type "thisisunsafe" and then make it someone else's problem when their expectations of "safety" are violated.

AnthonyMouse 1y ago
We started off with SSL/TLS being used for payments systems and logins where its absence is very important to not ignore. Then we said we should use it for everything, which is good, but now it's showing up in different contexts. If it says the certificate for your bank is expired, you need to stop. If it says the certificate for the 10 year old public blog post that was linked by a 5 year old Reddit post as describing the solution to your problem, that should not matter, and you just want to read the non-secret contents of whatever is on that page regardless of whether the site's maintainer turned on HTTP to HTTPS redirects and then neglected to renew the certificate. And people understand this, and people are rightfully going to devise workarounds for the second case, and it's ridiculous to expect them to not.
- seanwilson 1y ago
  > We started off with SSL/TLS being used for payments systems and logins ... If it says the certificate for your bank is expired, you need to stop. If it says the certificate for the 10 year old public blog post that was linked by a 5 year old Reddit post as describing the solution to your problem, that should not matter Non-HTTPS pages can be tampered with to inject any content into them e.g. into a blog post page, you could inject a login form ("sign in via Google to unlock this post"), a donation payment form ("donate for more content like this!"), or malware installers ("your browser is out of date, click to update" banner). I think pushing to protect non-tech savvy users makes sense here. I see even a lot of developers not understanding risks like the above, so it's a losing battle thinking non-techy users can be educated about it and be cautious enough.
  - snickerdoodle12 1y ago
    > Non-HTTPS pages can be tampered with to inject any content into them e.g. into a blog post page, you could inject a login form ("sign in via Google to unlock this post"), a donation payment form ("donate for more content like this!"), or malware installers. Who cares? The blog author could be malicious. The blog might have been sold 5 years ago and now hosts malicious content. Stop trying to nanny people, it's unbecoming.
    - krior 1y ago
      But you can atleast acknowledge that there is a difference between trusting a blog you are actively seeking out and all the entities between you and said blog, right?
      - snickerdoodle12 1y ago
        Not really. The context is some random reddit post from close to a decade ago linking it. Might as well have typed a random URL in your browser.
    - charcircuit 1y ago
      The people getting their money and accounts stolen care. The blog owner cares about the reputational hit. People who care about the success of the web care because it makes the web more risky than people using mobile apps.
      - snickerdoodle12 1y ago
        Yes and if you slit your wrists with a knife you will likely die. Do stupid things, bad things happen. Stop nannying people.
        charcircuit 1y ago
        So visiting a website is doing a stupid thing? Your recommendation is essentially telling people to stop visiting websites or accept bad things will happen to them. This is not a healthy viewpoint for growing the web.
- tptacek 1y ago
  The browser does not know what the web page is, and attacks on genuinely sensitive websites like banks wildly outnumber attacks on 10-year-old public blog posts. Browsers are doing exactly the right thing here.
  - AnthonyMouse 1y ago
    The certificate error on the 10 year old blog post isn't an attack, it's an old site that still exists but isn't actively maintained, which happens all the time.
    - tptacek 1y ago
      The browser cannot know that.
      - AnthonyMouse 1y ago
        That's why you need the human who can know that to make the decision.
        akerl_ 1y ago
        Isn’t that what’s happening? The browser shows a big warning with context and then the human makes a decision to click the “do this it’s fine” button. The exception is cases where the site operator has opted in to HSTS or similar to indicate their decision to rather disable access than allow insecure access.
        AnthonyMouse 1y ago
        The issue is that there shouldn't be a case where it's impossible to override it, because then the problem is unfixable when the misconfiguration occurs in that case. It's also overloading what HSTS is supposed to be for. Normally if you go to a site via HTTP, it loads without comment, which is less secure than loading a site via HTTPS that has an expired or self-signed certificate. HSTS it to say, don't do that. Allowing the site to tell the user agent to do something according to the wishes of the site owner in a way that can't be overridden by the user is not something that user agents should ever do.
- Dylan16807 1y ago
  > If it says the certificate for your bank is expired, you need to stop. No I don't. At least not if it's recent. A certificate that expired in the last month is roughly equal in safety to a certificate that's valid for another month or two. Expiration is a backup safety measure and the risk is mostly based on how long it's been since the certificate was issued. Unless any banks are going around leaking keys right after they expire for some weird reason?
  - yarekt 1y ago
    Err what? That certificate may well have been leaked, but because it expired the bank doesn’t not consider it an issue, no need to revoke it. Certificate validity is binary. either it all is, or it isn’t. this included “not before”
    - whydoyoucare 1y ago
      We scream at the expired certificate, yet happily let CloudFlare be an official MitM. How ironic is that? :)
    - AnthonyMouse 1y ago
      Not only that, banks are generally pretty diligent about that sort of thing and have enough customers and resources that if their website is misconfigured someone is going to report it immediately and they're going to fix it immediately. Which means that a certificate error on a bank site is suspicious. Whereas a certificate error on a disused blog is pretty much what you'd expect from a disused blog.
    - Dylan16807 1y ago
      The chance that happened is pretty low. What kind of breach gets old keys but nothing else of note?
alt187 1y ago
To be fair, you can click Advanced > Continue to something or other to bypass the SSL warning. I think.
- toast0 1y ago
  If your browser has information that the site enabled HSTS, the continue option isn't available ... that's what you need the cheat code for.
- molticrystal 1y ago
  For several types of certificate and ssl issues(HSTS , blacklisted/revoked certificates) that option is hidden and thus unavailble. Chrome can be a stickler, which is understandable as the majority of its users are not prepared to deal with the possible downsides of going to an untrusted page. So this is where the "cheat code" comes in handy: https://revoked.badssl.com/ https://revoked.badssl.com/ https://subdomain.preloaded-hsts.badssl.com/ https://subdomain.preloaded-hsts.badssl.com/ https://pinning-test.badssl.com/ https://pinning-test.badssl.com/ Then there are those which have no "cheat code" bypass, so you'd have to use some other method: https://rc4.badssl.com/ https://rc4.badssl.com/
  - mrkramer 1y ago
    I remember reading some blog post that badly configured SSL certificate will cause something like 90% of people bouncing off the website because they are scared of the big red Chrome warning. SSL certificate is actually an important UX factor.
anonymousiam 1y ago
100%! TLS is fragile, and working around it is often necessary. Certs can expire or be revoked (anywhere in the chain) and the renewal process can be bugged. The time on the client (required for confirmation of certificate validity window) could be wrong (either accidentally or deliberately). Requiring TLS on an inter-LAN connection is mostly useless, and impossible if no Internet gateway is available.
- sgjohnson 1y ago
  > Requiring TLS on an inter-LAN connection is mostly useless, and impossible if no Internet gateway is available. what do you mean? > Requiring TLS on an inter-LAN connection is mostly useless there are many ways to intercept inter-LAN traffic, and: > and impossible if no Internet gateway is available. DNS validation? Run your own CA and trust it in your intranet?
  - anonymousiam 1y ago
    1: If no gateway to the WAN exists, the certificate chain cannot be validated. 2: I did say "mostly" useless. If your LAN is at risk of spoofing or MITM, then TLS probably will not solve all of your problems anyway. 3: Obviously you can create a local cert and add it to your trust chain. You'll still have problems with various embedded devices that don't have a RTC.

by Y_Y 1y ago

AnthonyMouse 1y ago

We started off with SSL/TLS being used for payments systems and logins where its absence is very important to not ignore. Then we said we should use it for everything, which is good, but now it's showing up in different contexts. If it says the certificate for your bank is expired, you need to stop. If it says the certificate for the 10 year old public blog post that was linked by a 5 year old Reddit post as describing the solution to your problem, that should not matter, and you just want to read the non-secret contents of whatever is on that page regardless of whether the site's maintainer turned on HTTP to HTTPS redirects and then neglected to renew the certificate. And people understand this, and people are rightfully going to devise workarounds for the second case, and it's ridiculous to expect them to not.

seanwilson 1y ago
> We started off with SSL/TLS being used for payments systems and logins ... If it says the certificate for your bank is expired, you need to stop. If it says the certificate for the 10 year old public blog post that was linked by a 5 year old Reddit post as describing the solution to your problem, that should not matter Non-HTTPS pages can be tampered with to inject any content into them e.g. into a blog post page, you could inject a login form ("sign in via Google to unlock this post"), a donation payment form ("donate for more content like this!"), or malware installers ("your browser is out of date, click to update" banner). I think pushing to protect non-tech savvy users makes sense here. I see even a lot of developers not understanding risks like the above, so it's a losing battle thinking non-techy users can be educated about it and be cautious enough.
- snickerdoodle12 1y ago
  > Non-HTTPS pages can be tampered with to inject any content into them e.g. into a blog post page, you could inject a login form ("sign in via Google to unlock this post"), a donation payment form ("donate for more content like this!"), or malware installers. Who cares? The blog author could be malicious. The blog might have been sold 5 years ago and now hosts malicious content. Stop trying to nanny people, it's unbecoming.
  - krior 1y ago
    But you can atleast acknowledge that there is a difference between trusting a blog you are actively seeking out and all the entities between you and said blog, right?
    - snickerdoodle12 1y ago
      Not really. The context is some random reddit post from close to a decade ago linking it. Might as well have typed a random URL in your browser.
  - charcircuit 1y ago
    The people getting their money and accounts stolen care. The blog owner cares about the reputational hit. People who care about the success of the web care because it makes the web more risky than people using mobile apps.
    - snickerdoodle12 1y ago
      Yes and if you slit your wrists with a knife you will likely die. Do stupid things, bad things happen. Stop nannying people.
      - charcircuit 1y ago
        So visiting a website is doing a stupid thing? Your recommendation is essentially telling people to stop visiting websites or accept bad things will happen to them. This is not a healthy viewpoint for growing the web.
tptacek 1y ago
The browser does not know what the web page is, and attacks on genuinely sensitive websites like banks wildly outnumber attacks on 10-year-old public blog posts. Browsers are doing exactly the right thing here.
- AnthonyMouse 1y ago
  The certificate error on the 10 year old blog post isn't an attack, it's an old site that still exists but isn't actively maintained, which happens all the time.
  - tptacek 1y ago
    The browser cannot know that.
    - AnthonyMouse 1y ago
      That's why you need the human who can know that to make the decision.
      - akerl_ 1y ago
        Isn’t that what’s happening? The browser shows a big warning with context and then the human makes a decision to click the “do this it’s fine” button. The exception is cases where the site operator has opted in to HSTS or similar to indicate their decision to rather disable access than allow insecure access.
        AnthonyMouse 1y ago
        The issue is that there shouldn't be a case where it's impossible to override it, because then the problem is unfixable when the misconfiguration occurs in that case. It's also overloading what HSTS is supposed to be for. Normally if you go to a site via HTTP, it loads without comment, which is less secure than loading a site via HTTPS that has an expired or self-signed certificate. HSTS it to say, don't do that. Allowing the site to tell the user agent to do something according to the wishes of the site owner in a way that can't be overridden by the user is not something that user agents should ever do.
Dylan16807 1y ago
> If it says the certificate for your bank is expired, you need to stop. No I don't. At least not if it's recent. A certificate that expired in the last month is roughly equal in safety to a certificate that's valid for another month or two. Expiration is a backup safety measure and the risk is mostly based on how long it's been since the certificate was issued. Unless any banks are going around leaking keys right after they expire for some weird reason?
- yarekt 1y ago
  Err what? That certificate may well have been leaked, but because it expired the bank doesn’t not consider it an issue, no need to revoke it. Certificate validity is binary. either it all is, or it isn’t. this included “not before”
  - whydoyoucare 1y ago
    We scream at the expired certificate, yet happily let CloudFlare be an official MitM. How ironic is that? :)
  - AnthonyMouse 1y ago
    Not only that, banks are generally pretty diligent about that sort of thing and have enough customers and resources that if their website is misconfigured someone is going to report it immediately and they're going to fix it immediately. Which means that a certificate error on a bank site is suspicious. Whereas a certificate error on a disused blog is pretty much what you'd expect from a disused blog.
  - Dylan16807 1y ago
    The chance that happened is pretty low. What kind of breach gets old keys but nothing else of note?

alt187 1y ago

To be fair, you can click Advanced > Continue to something or other to bypass the SSL warning. I think.

toast0 1y ago
If your browser has information that the site enabled HSTS, the continue option isn't available ... that's what you need the cheat code for.
molticrystal 1y ago
For several types of certificate and ssl issues(HSTS , blacklisted/revoked certificates) that option is hidden and thus unavailble. Chrome can be a stickler, which is understandable as the majority of its users are not prepared to deal with the possible downsides of going to an untrusted page. So this is where the "cheat code" comes in handy: https://revoked.badssl.com/ https://revoked.badssl.com/ https://subdomain.preloaded-hsts.badssl.com/ https://subdomain.preloaded-hsts.badssl.com/ https://pinning-test.badssl.com/ https://pinning-test.badssl.com/ Then there are those which have no "cheat code" bypass, so you'd have to use some other method: https://rc4.badssl.com/ https://rc4.badssl.com/
- mrkramer 1y ago
  I remember reading some blog post that badly configured SSL certificate will cause something like 90% of people bouncing off the website because they are scared of the big red Chrome warning. SSL certificate is actually an important UX factor.

anonymousiam 1y ago

100%! TLS is fragile, and working around it is often necessary. Certs can expire or be revoked (anywhere in the chain) and the renewal process can be bugged. The time on the client (required for confirmation of certificate validity window) could be wrong (either accidentally or deliberately). Requiring TLS on an inter-LAN connection is mostly useless, and impossible if no Internet gateway is available.

sgjohnson 1y ago
> Requiring TLS on an inter-LAN connection is mostly useless, and impossible if no Internet gateway is available. what do you mean? > Requiring TLS on an inter-LAN connection is mostly useless there are many ways to intercept inter-LAN traffic, and: > and impossible if no Internet gateway is available. DNS validation? Run your own CA and trust it in your intranet?
- anonymousiam 1y ago
  1: If no gateway to the WAN exists, the certificate chain cannot be validated. 2: I did say "mostly" useless. If your LAN is at risk of spoofing or MITM, then TLS probably will not solve all of your problems anyway. 3: Obviously you can create a local cert and add it to your trust chain. You'll still have problems with various embedded devices that don't have a RTC.