Hacker News Reader

Comment by welder | Hacker News Reader

As long as you visited Gmail within the last 126 days, your browser won't allow you to visit the HTTP version of Gmail because they have HSTS[1] enabled:

> strict-transport-security:max-age=10886400; includeSubdomains

This sensational article fails to mention that.

To protect your website visitors, enable the HSTS header on your web server. Basically just use SSL Labs[2] and fix everything until you have an A+ rating.

[1] https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security

[2] https://www.ssllabs.com/ssltest/analyze.html?d=wakatime.com

View on HN

The article does mention HSTS. And for many sites on several browsers you don't have to have previously visited them because the HSTS list is preloaded.

More info here, also you can submit your own site: https://hstspreload.appspot.com/

I did this a while back for several of my domains and it was easy and fast. One new problem I have is that after getting on the list and moving the static HTML sites over to CloudFront's free HTTPS offering, I see Chrome 50+ will require that you keep sending the 'preload' header directive, which is impossible to do with CloudFront. Bummer.

If anyone from AWS sees this, please note this is one more reason your users want the ability to send extra headers. Even if it's only a select few headers chosen from a dropdown list, this added functionality would come as very welcome news.

My personal grief with HSTS is that it pretty much requires you to have installed and trusted one random 400 CA collection or the other. If you have uninstalled/distrusted most of them, no current browser will allow you to access a HSTS enabled domain using one of those distrusted CAs.

There is no override to skip and accept an encryption-only connection. Which is what I would have gotten with HSTS as well, because without independent verification the CA system is a lot, but not the mutually trusted third party it claims to be.

I'm quite happy that there's no way to bypass the intersitial for HSTS sites. Preventing non-technical users from clicking through SSL warnings (which is very common) is definitely more important than supporting a use-case that only affects a very, very small subset of users. If there's enough demand, I'm sure someone's going to introduce a hidden flag or some kind of extension that allows you to do this.

I understand why it is done; and that the new error pages that are not filled with technical details are a net win overall. But there are people out there that need those technical details, so that other people do not have to see them.

Chrome at least, does allow HSTS errors to by overridden (and "safe browsing" warnings). It's just not exposed visibly. There is a deliberately undocumented "cheat code" that you need to type.

If you mean the one starting with D, then I may have mistyped and need to try that again. Thought that did not work for the HSTS block.

They've changed the code from that, the new one starts with B.

What is this code?

I intentionally didn't mention it. You should be able to find it from what I said if you really need it.

You don't even need Gmail in your HSTS set if you have HTTPS Everywhere installed in your browser.

Reply on news.ycombinator.com