Help I accidently enabled HSTS on localhost

https://bartwullems.blogspot.com/2023/07/help-i-accidently-enabled-hstson.html

by freedude • 3 years ago

133 103 3 years ago

bartwullems.blogspot.com

nyanpasu64• 3 years ago

We are now in an era where the only browsers people think about are Chromium reskins and forks.

gerdesj7• 3 years ago

Perhaps, but I have personally gone back all in with Firefox. I've gained the ability to not have a wanker tell me how https works and be a total pain. Cr browsers will never enter saved creds into a site that isn't "fully trusted". FF will respect your choice after quite a lot of admonishment.

I've been using SSL and TLS longer than some of the knobends programming these fucking things have been alive. There is a difference between being opinionated and a dick. FF is opinionated and Cr is a dick.

To be fair: FF and Cr have an equally awful "show me the fucking cert and stop making my life more miserable" workflow. Why is it such a drawn out routine to see the cert details? I personally spend a lot ... a lot of my time with SSL/TLS - and you fuckwits literally make my life harder by hiding it away in some silly "don't worry your pretty head" thing.

My first browser was telnet and I am mildly irritated.

netsharc• 3 years ago

Recently I opened Firefox and it said "Thank you for loving Firefox"... Geezus, maybe I should fork it and add the Overly Attached Girlfriend memes all over the place: https://knowyourmeme.com/memes/overly-attached-girlfriend

_jal• 3 years ago

Heard.

FF is the least irritating of a bad lot. I'd really like a "programmer's build" or something, with knobs for this stuff - FF used to be better about exposing them in preferences, even if it was a bit obscure.

I can usually get by with curl and/or wget for troubleshooting purposes, but dealing with broken things you actually need to use to fix is far more annoying than it should be, "for my own good".

The thing that irrationally irritates me the most about FF is the uncounted minutes of my life spent waiting for the countdown buttons to let me click them.

wbl• 3 years ago

Because we have data showing that anything less leads to easy impersonations of sites. Browser security UI is hard.

nijave• 3 years ago

If you have admin/root, it's usually easier to just add the leaf cert to the CA trust store.

dclowd99015• 3 years ago

Kind of tangential: I recently wanted to move the hosting of my hobby/side gig site to an S3 static site (site generated by me). Thought it would be a few configuration details in s3 and good to go.

A full day later just to be usable in Chrome (since it defaults to https) I had to get a cert and standup a CDN just to make sure your average dingus web user wouldn’t try to navigate to my page and hit nothing.

To be clear, my site doesn’t even have Javascript, and certainly no form submission. HTTPS is complete overkill and now it’s even more overkill overkill since I could be bombarded by half the world population and my site would likely stand up to it.

In a way, they killed the hobbyist website with that bullshit.

rkagerer• 3 years ago

I agree it's retarded how the important features keep getting buried under deeper sequences of clicks.

jofla_net• 3 years ago

absolutely. add cache behavior to that as well, nothing is cached from non "fully trusted" pages either...

BrandoElFollito4• 3 years ago

Probably because 99.985% of people who use a browser call it "the internet" and of these a tiny fraction knows that if there is a padlock nothing bad can happen (yes I know that the padlock is now gone because everything wasn't that safe, apparently).

Then you have the 0.0something population that heard that a certificate ensures you that the site is the one you want to go to. And since it is not always the case they have up.

Then there is the sub-Planck- number of these who understand what a cert is and what it is for.

deaddodo2• 3 years ago

More importantly than that...if you need HSTS on localhost, you're doing something wrong.

Add an exception in your code for HSTS on localhost, if it's required. Or, use a container and set up HSTS on its mounted IP.

mschuster91• 3 years ago

It's not that anyone needs HSTS on localhost, just that it's damn easy to have your web app's backend accidentally pass out an HSTS header.

fhfthbcdth• 3 years ago

Back in the day it was only ie. So… it could be worse.

julianlam2• 3 years ago

I thought that was funny too... Chrome, Edge, and Brave.

Hummm, I wonder why the net-internals URL is identical!

dugite-code• 3 years ago

I mandated Firefox on all the office machines. I'm doing my part

Espionage7246• 3 years ago

Firefox subreddit took part in that blackout nonsense when I was trying to find details about a flag; forget anything to do with Mozilla if they're for hiding information a whim; the API changes didn't even involve Mozilla in any manner

I was also a little irked at a bugzilla response about a request to allow importing local bookmark files on Firefox for Android asking who would would really use it. For real a privacy-respecting browser can't figure out why someone would want to not use their half-broken online sync? If Chromium had that, I'd have been off Firefox that same day.

Liquid_Fire• 3 years ago

You're blaming Mozilla for what the Firefox subreddit did, which is not run by Mozilla?

Espionage7246• 3 years ago

It looks like I was wrong to assume the subreddit had any sort of official status from Mozilla. It'd be nice if they came right out and disowned any association of that subreddit drama though.

pjmlp• 3 years ago

Pushed by the same folks that used to complain about IE monopoly.

kykeonaut2• 3 years ago

HN is a weird place to ask for technical support.

edit: come on guys isajoke ;-;

evbogue3• 3 years ago

the brightest minds of our generation, all sitting around with nothing to do? It's the best place

roboror• 3 years ago

They're not asking for support. They encountered a problem and wrote a post about how they fixed it.

NoZebra120vClip• 3 years ago

Then, it would seem that deleting "Help" from the front of the headline would make a better HN title. (And are we in the business of retaining misspellings?)

evbogue3• 3 years ago

well at least your localhost is secured

Am4TIfIsER0ppos• 3 years ago

How can you be sure that someone isn't MITM? Did you get the cert signed by an authority?

selcuka2• 3 years ago

I guess I'm the authority when it comes to localhost.

dclowd99015• 3 years ago

By the authority of myself.

derefr2• 3 years ago

Okay, great, Chrome has a place where you can delete HSTS pins.

Now how do I delete a cached Accept-CH value? It's been two months and any computer I accessed the test server through while it was sending the bad Accept-CH value, still chokes for literally any request made to the test domain. (And no, clearing site data doesn't do anything.)

(If you're wondering what I did that screwed things up so bad: I had the server send an Accept-CH response header in response to an OPTIONS request, in the hopes that it would be delivered in the CORS preflight and therefore get me high-entropy client hints sent in the actual [same-site] XHR. It was delivered in the CORS preflight alright...)

justinclift• 3 years ago

Sounds like you'd need to delete your browser user profile (which holds all the stored info for your user), so it starts a new "empty" one like a new user would have.

packetlost• 3 years ago

That's the nuclear option though. It shouldn't be necessary.

tedunangst• 3 years ago

Somewhat relatedly: a site with HSTS is not supposed to let you click through an invalid cert warning. The browser should also ignore HSTS with invalid (self-signed) certs. But there are bugs, and thus you can find yourself in the position where you're unable to ignore the cert error on a site that never had a valid cert.

account42• 3 years ago

Somewhat relatedly: a site with HSTS is not supposed to let you click through an invalid cert warning.

A good user agent SHOULD ignore parts of the spec that go against the user's wishes.

oasisbob• 3 years ago

Could be worse!

Seattle.gov started serving with HSTS `includeSubDomains; preload` over a month ago, broke all sorts of subdomains, and are still picking up the pieces.

City council ordinances and resolutions are hosted at http://clerk.seattle.gov/, not that it matters, since you can't view the site.

andersa• 3 years ago

After getting a popup about it not being secure, I can visit this site just fine in latest Chrome.

askiiart• 3 years ago

I can view the HTTP version of the site just fine, but I seem to get stuck when trying it over HTTPS.

Cyphase• 3 years ago

To those saying you can view the site; it's presumably because you didn't go to seattle.gov when it was setting HSTS on subdomains. Presumably the parent did and is now not able to access http://clerk.seattle.gov/ because of that.

Espionage7246• 3 years ago

That site loads fine for me in Firefox.

I like how Seattle has their own ordinance site; I don't know how other places do it, but the town I'm in uses eCode360

1vuio0pswjnm7• 3 years ago

   x=clerk.seattle.gov
   printf 'GET / HTTP/1.1\r\nHost: '$x'\r\nConnection: close\r\n\r\n' \
   |nc -vvn 156.74.251.24 80

There's a line in the fwd proxy config for these rare situations where I need to use HTTP without TLS

   use_backend b407-notls if { hdr(host) -m str -f /somedir/hosts-notls.txt }

Normally the proxy will use TLS for any request from any application, not just a web browser, regardless of whether URL begins with http:// or whether it's sent to port 80

To avoid HSTS supercookies^1 I can also add a response header

   http-response add-header Strict-Transport-Security max-age=0

but I have not needed to do that.

1. https://nakedsecurity.sophos.com/2015/02/02/anatomy-of-a-bro...

If the site is on some pre-approved list compiled into the browser, I can remove it and recompile. But I am not interested in such user-hostile browsers for frequent use. Good for online shopping, banking, other commercial transactions, but not for non-commercial purposes.

The ubiquity of TLS is of course a relatively recent phenomena

It seems like Internet Archive still does lots of crawls of port 80; I wonder if that's also true for Common Crawl

If so, it's interesting to think about how much of the data used to train ChatGPT and other AI may have come from crawls over port 80

On ChatGPT data sources:

https://www.searchenginejournal.com/how-to-block-chatgpt-fro...

tinus_hn• 3 years ago

So now all of their public sites will have to implement https. Seems like a win to me.

dcow3• 3 years ago

HSTS will go the way of password rules and password change requirements. And by that I mean people that don’t really know anything about security will ask for it because it checks a box and someone will add it because they’re paid to not have opinions and just write code and in 20 years we’ll still be fighting a stupid battle against HSTS because we can’t have nice things. HSTS was dead in the water from day one.

minitech• 3 years ago

HSTS was dead in the water from day one.

No, it has served and is serving a useful purpose (reducing MITM risk) for a large number of websites.

dcow3• 3 years ago

You know what, I was thinking of HPKP, which is obsolete. HSTS, while I doubt it’s actually prevented a single adversarial MITM, isn’t a terrible idea.

BrandoElFollito4• 3 years ago

Could you explain shortly what can be prevented?

The hard part is I believe to spoof the DNS entry and then get a cert from a CA they is in the browser root. Were there cases where HSTS actually stopped something after that? (serious question - I always wondered how much of a peripheral problem HSTS solves)

andrewstuart• 3 years ago

You have to leave the Internet now.

akx• 3 years ago

You can also bypass Chrome security warnings that don't have the "Continue anyway" link by typing `thisisunsafe` on the page (yes, blind). You'll know if it worked by the last `e`.

dewey• 3 years ago

I thought you were kidding until I looked it up. Apparently this is also changed from time to time!

The chrome developers also do change this periodically. They changed it recently from badidea to thisisunsafe so everyone using badidea, suddenly stopped being able to use it.

jeroenhd• 3 years ago

They had to change "badidea" because in some places typing it into error pages had become part of instruction manuals.

Now people ignoring HTTPS errors will at least k ow why it's a bad idea!

veave• 3 years ago

I like this and Firefox has nothing like it.

If you ask around (like in reddit) they'll tell you "hurr durr but the rfc", "hurr durr security". Thank you, but I am an adult, and this is a computer I bought with the money I earned. I want to be able to tell my computer what to do. /rant

jspaetzel• 3 years ago

So many things require HTTPS now I always use HTTPS during development with local certs via mkcert

jve• 3 years ago

For Windows/PowerShell users:

    New-SelfSignedCertificate -CertStoreLocation Cert:\CurrentUser\My -DnsName "localhost"

https://learn.microsoft.com/en-us/powershell/module/pki/new-...

rezonant3• 3 years ago

It's a good practice but worth noting that almost all web platforms features that require a secure context work on localhost without HTTPS

sebazzz• 3 years ago

The problem is that Chrome considers the entire localhost regardless of port within scope of HSTS. Firefox does this only per port, so you don't run into these issues.

dorianmariefr• 3 years ago

Happened to me many times and that chrome://net-internals/#hsts is not very user-friendly (no feedback if it was successful or if the domain wasn't even there).

Anyway, golden HN thread here

Help I accidently enabled HSTS on localhost

Related Stories