Comments

You must log in or register to comment.

Wahaha wrote

I never understood the craze over https myself. Or why browsers prevent you from visiting a site with an expired certificate. At some point they removed the "I don't care, give me the site" option.

2

BlackWinnerYoshi wrote

Actually, you can visit sites with an expired certificate, just not those that have HTTP Strict Transport Security enabled, which, for me, is the biggest problem when a site has Clownflare, since the way I distrust Clownflare is not by the awful addon that even Dig Deeper doesn't recommend any more (compare), but by removing the certificate in LibreWolf, so obviously, it thinks they're insecure. And that's true, since Clownflare decrypts your TLS traffic, but I still use Discord regularly, and since it has HSTS, I have to use ungoogled-chromium.

As for Chromium, there is a way to bypass HSTS there, even though the RFC 6797 standard doesn't allow that, but it also looks like they're rotating the way it's done when the awareness increases, and they might have removed it at this point? It's kind of confusing for me.

And, well, using HTTPS for these kinds of websites is useless. And yes, if you still want some kind of security, use VPN or Tor (pro tip: connect to a VPN like Mullvad first, then to Tor), but you could also use the Wayback Machine or archive.today for an easier way. You also get a permalink to the website in case something happens.

5