Neverssl Uses SSL | Hacker News Reader

Neverssl Uses SSL

twitter.com

50 pointsnotmysql_37 comments

They support SSL because some browsers force https, but they then force a redirect to a non-SSL page. Seems reasonable. I think I may be missing the point of this being posted on HN. Does it cause issues in certain workflows or something?

Nope, people are just looking for their daily dose of outrage.

Which browsers force https when you type in http:// before the domain?

Firefox 102.10.0esr seems to do this here.

I type into the address bar: `http://example.com` and it corrects it to the HTTPS version. Even when I try to change the URL back to the `http://` it goes to the HTTPS version. When I try the same with curl as in `curl -v http://example.com` I can see the HTTP traffic coming through correctly i.e. the site still supports HTTP.

Note that I have configured "Don't enable HTTPS-Only Mode" in the Firefox settings. I use some addons although none to specifically redirect my requests to HTTPS...

Is it possible that example com is redirecting you

I am using Firefox Nightly 114.0a1, with "Don't enable HTTPS-Only Mode" enabled, and a visit to http://example.com works as expected (a GET from http).

Enable the web developer tools (Menu->More Tools->Web Developer Tools), visit the site again, and see if it is directly visiting the site or getting a redirect.

The developer tools Network tab directly indicates the first connection as being HTTPS. No redirect shown there.

I additionally tested with my own site: http://masysma.net/31/web_main.xhtml. It is configured to not redirect to HTTPS except for the root node (http://masysma.net). It is not configured to behave any differently for user agents and hence the redirection (or no redirection) behaviour can also be checked by the commandline tools that print the course of the redirection (like curl, wget).

Chrome, in an experiment they've rolled out to half their users in preparation of making it the default. https://chromium.googlesource.com/chromium/src/+/19719792bbd...

Regardless, the point of neverssl.com is that a non-technical user can learn "if I'm on a new wifi network and I see errors when I try to visit pages I can enter neverssl.com and get to the wifi login". Adding ssl + a redirect is much easier and more effective than trying to retrain everybody to manually type http.

It probably should have been named wifilogin.com or something. But renaming it has the same retraining issue.

It's the dichotomy between the name, neverSSL, and the fact that it's now doing SSL, that makes it interesting, because the name and proclamation is no longer accurate. Also it was hotly discussed yesterday so there's points for this story reflected from that.

Wait until people hear about a popular sex act and it being a misnomer.

They missed an opportunity to claim that they only support TLS, not SSL. Unless they're also accepting SSLv3 connections.

Looks like they don't:

  $ openssl s_client -ssl3 -connect neverssl.com:443
  CONNECTED(00000003)
  140453876520616:error:1409442E:SSL routines:SSL3_READ_BYTES:tlsv1 alert protocol version:s3_pkt.c:1315:SSL alert number 70
  140453876520616:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:637:

I like http://example.com as it's IANA owned (or maybe ICANN) so more stable than most hobbyist versions.

https://en.wikipedia.org/wiki/Example.com

I usually use http://captive.apple.com for the same functionality of NeverSSL and if you're using any Apple devices, that is the address iOS/iPadOS/macOS would use for wifi login

I used to use detectportal.firefox.com but now it downloads some bin file for whatever reason

What's the point of this site? Why not just use http://example.com?

What are you referring to? It sounds like you're confused why more than one person made a solution to a problem. There's also captive.apple.com, among others.

Are there other domain names reserved by IANA for the same purpose? I trust the people in charge of domain names to not change their minds on something like this more than I would a company (such as Apple).

There are not.

The purpose of example.com is not for getting to a captive portal page. It is to a domain set aside for use in examples and documentation. AFAIK, there is no guarantee that it won't start setting the HSTS header at some point.

What is the purpose of http://example.com? Why not just use http://neverssl.com?

Example.com is reserved by IANA and should be reliable to exist for a long time. From the "more information" link:

>As described in RFC 2606 and RFC 6761, a number of domains such as example.com and example.org are maintained for documentation purposes.

neverssl.com uses JavaScript to redirect you to a random subdomain. This works around poorly behaved caches. It also (as the link discusses) redirects https to http.

It's poorly named. It's narrowly tailored at helping potentially non-technical users work around poorly implemented captive portals.

> some browsers and sites automatically use https even when you don't type that in.

My experience is that many of them do. I think mine do, by default.

There's a number of rules around using https first/only. I recall that all .app domains only use https as well as any domain using HSTS.

- https://www.eff.org/https-everywhere/set-https-default-your-...

Since November 2021, not sure this is news..

True, headline deserves a (2021). But, it was news to me yesterday when it came up in a comment thread here.

When I was trying to use the site a few weeks ago, port 80 wasn't working at all. Just port 443/HTTPS. So not only does it fail at never using ssl, but it also sometimes fails at doing HTTP.

Is this a joke? Seems to be the most bizarre example of a pivot for a service with such a straightforward purpose.

It’s like a vegan meat company also selling pork sausage just in case they miss out on some passing carnivores.

Did you read the tweet?

They had to add this because browsers now often auto append https:// to manually typed domain entries anyway. So it loads on https, then redirects to a http-only subdomain.

This way you can still find any captive portals needing you to login/accept T&Cs/etc. Which is what neverssl’s core purpose actually is.

Sooo, you're behind a captive portal which blocks internet access. So you access an https website on the internet that will redirect you to http. Wat.

The browser cachable bit is critical here. By having visited the page before, even though the network won’t allow traffic yet, the cached page performs a redirect to an unsecured page that the local captive portal CAN intercept.

What Joshua said, plus some hotspots also whitelist some IPs, allow some HTTPS temporarily. The world of hotspots is a real mixed bag on how they do things.

Unless I'm missing something embarrassingly obvious, redirecting HTTPS->HTTP doesn't help those use cases at all.

When behind a captive portal, you need to load some page over http to allow the device MITM you. Nice devices will have built in captive portal checking, but not all devices are built nicely.

On some devices typing “neverssl.com” will try to resolve https://neverssl.com without any form of http fallback. It may be actually pretty difficult to type :// on some devices too.

On these devices, if you ever visit “neverssl.com” when not behind a captive portal, you will get a a catchable redirect to http.

Then the next time you are behind a captive portal, if you type “neverssl.com” the browser resolve it to https like always, but will remember the cached redirect, and try to load the http version, letting you land at the captive portal page.

Did you actually read the post? It's quite clear, and doesn't break the purpose of the site at all. It actually makes it work in more places.

Reply on news.ycombinator.com