NeverSSL • Hacker News Board

Re: NeverSSL

#31

Post by bailey-maitland » Sat, Nov 02, 2019, 10:12 PM UTC

etskinner wrote: post #6

http://example.com also does this, albeit without the promise of never switching

Another one: http://http.rip

Re: NeverSSL

#32

Post by MrEldritch » Sat, Nov 02, 2019, 10:13 PM UTC

1123581321 wrote: post #24

My favorite to use is http://perdu.com/ I don’t know where I found it, but it’s charming!

Mine is always good old http://zombo.com.

Re: NeverSSL

#33

Post by arkadiyt » Sat, Nov 02, 2019, 10:14 PM UTC

Serves a completely different purpose but I also frequently use badssl.com for testing TLS configurations (for instance you can load it on a kiosk, gym screen, etc - if it loads successfully then your connection is not being verified and could be MITM-ed)

Re: NeverSSL

#34

Post by ivraatiems » Sat, Nov 02, 2019, 10:16 PM UTC

gk1 wrote: post #2

I use captive.apple.com if a public network fails to load the login/getting-started page.

http://www.msftconnecttest.com/redirect is Microsoft's equivalent, in case that ever doesn't work.

Re: NeverSSL

#35

Post by Thorrez » Sat, Nov 02, 2019, 10:17 PM UTC

etskinner wrote: post #6

http://example.com also does this, albeit without the promise of never switching

In both Chrome and Firefox, when I type "example.com" into the URL bar, I go to https://example.com , probably because I've visited the https site before and they remember that. So I do not recommend example.com .

Re: NeverSSL

#36

Post by shakna » Sat, Nov 02, 2019, 10:20 PM UTC

etskinner wrote: post #6

http://example.com also does this, albeit without the promise of never switching

And with a different relationship:

* neverssl might be bought out, or re-registered, at some time in the future.

* example.com is a IANA reserved domain [0], which whilst it doesn't guarantee they'll never deploy SSL, does mean nobody else can register it, ever (RFC 6761) [1].

[0] https://www.iana.org/domains/reserved

[1] https://tools.ietf.org/html/rfc6761

Re: NeverSSL

#37

Post by kees99 » Sat, Nov 02, 2019, 10:23 PM UTC

Thorrez wrote: post #35

etskinner wrote: post #6

http://example.com also does this, albeit without the promise of never switching

In both Chrome and Firefox, when I type "example.com" into the URL bar, I go to https://example.com , probably because I've visited the https site before and they remember that. So I do not recommend example.com .

Indeed, "browser.urlbar.autoFill" option (enabled by default) would do that in Firefox.

There should be no forced https redirection if you fill in http:// prefix by hand though. At least for now, until example.com adds HSTS headers.

Re: NeverSSL

#38

Post by cwyers » Sat, Nov 02, 2019, 10:23 PM UTC

So, sites like this are useful. (It's certainly better than memorizing the URL that various hotels use for their wifi portals, which I have done before, sadly.) But is there anybody working on solving this problem transparently to the end user? It seems user-hostile to require people to remember a non-HTTPS URL, especially as more and more sites move.

Re: NeverSSL

#39

Post by crazysim » Sat, Nov 02, 2019, 10:24 PM UTC

etskinner wrote: post #6

http://example.com also does this, albeit without the promise of never switching

I think the only promise example.com has is that the domain will always exist.

Re: NeverSSL

#40

Post by rjeli » Sat, Nov 02, 2019, 10:24 PM UTC

Everyone seems to understand this but me... how does connecting to a non-ssl website disable ssl on other sites?