2022 Developer Survey is open! Take survey.
29 votes
Accepted

Is it safe to ignore/override TLS warnings if user doesn't enter passwords or other data?

Of course the site should upgrade its TLS setup. But, until the site owner does that, the user that needs to download the file from the site must look for a workaround. The user can proceed to ...
user avatar
  • 19.6k
10 votes

Is it safe to ignore/override TLS warnings if user doesn't enter passwords or other data?

You need TLS, no excuses. Even if the user isn't sending anything confidential to the site, they are downloading from it. Any attacker in the position to perform a MitM attack will be able to change ...
user avatar
  • 50.5k
9 votes

Is it safe to ignore/override TLS warnings if user doesn't enter passwords or other data?

Yes, you need TLS for read only websites. Because otherwise a rogue WiFi hotspot can serve whatever content it wants on your domain and the user has no way to know it's not authentic. Also, browsers ...
user avatar
  • 7,633
8 votes

Is it safe to ignore/override TLS warnings if user doesn't enter passwords or other data?

It depends on the stakes involved. The broken TLS will not, by itself, damage the browser, the downloading computer and the file. If the file is "look how funny my dog jumps" video and the ...
user avatar
  • 3,395
6 votes

Does the "auto formfill" feature in Chromium-based browsers actually send this to the webpage?

Technically it is possible that there is a script that reacts on the content change events and sends data to the web site even if you have not submitted login data explicitly. It depends on the ...
user avatar
  • 7,926
5 votes

Is it safe to ignore/override TLS warnings if user doesn't enter passwords or other data?

There are, to my knowledge, 2 risks of connecting to a site without TLS, both of which have been mentioned in some ways, but I wanted to give my own spin on them: Safety. The potential for man-in-...
user avatar
  • 151
3 votes

Does the "auto formfill" feature in Chromium-based browsers actually send this to the webpage?

The easy way to code it would be that such content is available to the javascript website. It is possible that the browser has protections to "make it look like it's not filled" (this is ...
user avatar
  • 17.4k
3 votes

Are CSRF attacks a thing of the past?

Are CSRF attacks a thing of the past? No First of all, there are legitimate reasons to use SameSite=none. One obvious example is any site where the back-end serves multiple front ends via CORS, but ...
user avatar
  • 38.7k
1 vote

Databases for compromised passwords that browsers use

I don't know for sure, but it seems very likely that large, well-resourced, security-conscious orgs (such as Google) would maintain their own corpus of commonly compromised passwords. I would also ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible