Hacker News Reader

Comment by reaperman | Hacker News Reader

I thought this was fairly common?

It is and it's a best practice. I've never heard anyone complain about this.

Most security scanning software will ding any site that doesn't use HSTS

You don't see why Firefox refusing to connect would be annoying? I don't care whether the blog about curl is encrypted in transit or not and I do care about a forced change to chrome to see the content.

I can visit it in Firefox 123 just fine. Tests like [1] say the site works on everything from Firefox 31 to Firefox 73.

You're probably the target of a MITM attack. Or you've done something weird, like taking a job with an employer that MITMs your web traffic then refusing to install their MITM certificates.

[1] https://www.ssllabs.com/ssltest/analyze.html?d=daniel.haxx.s...

I once was talking to somebody who was a brother in law staying on the couch sort of deal.

They were complaining that their battery life on their phone just got decimated recently and kept dying over and over. I believe I was helping to troubleshoot, so I had them turn on airplane mode, he flipped it and complaining of something else annoying happening and saying oh yeah my phone airplane mode doesn't work, I still get internet. I was totally baffled, it was all very weird to me.

A little bit of time later that person got busted as a part of a big local drug bust. I'm assuming that's how they tap phones.

I'm definitely the victim of Vodafone screwing with the connection. They want me to prove my identity by giving them a card number, despite already having that because I pay for the SIM connection, but both their website and their mobile app are so poorly implemented that it's not actually possible to meet that inherently meaningless request.

It seems Firefox notices this and refuses to contact the site, and Chrome notices this and lets me override, but generally I don't see this failure mode. I wonder what is significant about this particular website.

I unsportingly separate work hardware from personal, no idea if my employer's likely MITM nonsense would have the same behaviour.

Learned something today, albeit with details missing. Oh and Vodafone employee if you're reading this? None of your tech works for shit.

Firefox connects to https://daniel.haxx.se/blog/2024/04/22/curl-is-just-the-hobb... fine. Are you connecting to a http:// URL instead? If yes, why?

But it's working just fine in my Firefox, so it sounds more like there's something wrong on your end by either security software or on the network level.

Common misconception, but Https / TLS provides a combination of gaurantees, and the one cannot work without the other:

Encrypted transit but you might be talking with the hacker on the other end == worthless.

And with plaintext transit you cannot prove integrity during transit AND also not prove talking with the proper endpoint.

In short: Browser really is warning you that something is fishy. Don’t shoot the messenger.

I think his complaint is that HSTS also prevents the user from overriding it and Firefox is complying, which I agree is a bit annoying.

Complaining about no overrides is complaining about not being able to ignore quite serious symptoms.

Firefox makes you fix the root problem.

Bingo. Primarily because I don't really mind if reading this post is compromised, but at least partly because I hadn't thought through the implications of vodafone intercepting traffic.

Reply on news.ycombinator.com