Hacker News Reader

Comment by kkl | Hacker News Reader

As far as I know almost all browser security warnings are overridable. The only one that comes to mind that does not have a click-through option is when a HSTS-enabled site fails a validation check.

View on HN

There's a couple fatal errors, ERR_CERT_CONTAINS_ERRORS, ERR_CERT_REVOKED, ERR_CERT_INVALID, ERR_CERT_NOT_IN_DNS: https://github.com/adobe/chromium/blob/cfe5bf0b51b1f6b9fe239... Not sure which one of these catches HSTS failures.

This one in particular feels very strange, since there's actually nothing bad actively happening with the connection, it's more of a policy decision.

My understanding is that you can't know that nothing bad is actively happening with the connection since SHA-1 is no longer a strong hash, so it's basically (hand-wave) no different from an HTTP connection.

So why don't they present any warning on HTTP connections?

It's not "basically no different" from an HTTP connection, it's strictly better than an HTTP connection, but not as good as a cert made with a more modern hash. (For that matter the same argument applies to self-signed certificates: you're still keeping a third party from snooping on the phishing attempt the MITM is giving you, which is itself a Good Thing.)

I agree, insecure HTTPS should be treated like HTTP. But this issue has been argued to death, especially over self-signed certs, and our side lost.

All major browsers are moving towards this. Starting with the tiny icons changing colors they are beginning to make HTTP as insecure. Yes, it's very slow but at least they have started moving.

Quite a few are only overridable in about:config, like: (if I recall correctly)

  * DH short exchange keys
  * NTLM1 passwords

I just went digging through the about:config options and couldn't find a way to force SHA-1 off. Why are they gradually rolling this out to beta users if they've purposely downloaded the Developer Edition?

If you have explicitly dis-trusted a certificate you can't click-through either.

I think HPKP might also suffer the same issue.

It depends on who you ask, but I personally don't think hard certificate validation failures are a bad thing.

HKPK has the potential problem that losing / compromising 2 keys leaves your site unavailable until the pin expires.

This is a common theme in this thread but I'll re-state it here:

Web browsers cannot reliably distinguish between a configuration mistake and an attack.

For this reason, I think hard HPKP fails are a good thing. For those who opt-in to HPKP, this is a risk one takes in exchange for greater control over certificate validation.

Reply on news.ycombinator.com