Too much security

[logg.sar]

Hi there

I have an very own private site on my very own root server.
The root server will be finished in 3 months, but its still running. Therefore I didn´t extended the certificate after ending validity.

Now vivaldi prevents me from using MY VERY OWN SITE

This SUCKS.

Absolutely.

I get the usual message:

*xxxxxxxx.eu normally uses encryption to protect your information. When Vivaldi tried to connect to xxxxxxxx.eu this time, the website sent back unusual and incorrect credentials. This may happen when an attacker is trying to pretend to be xxxxxxxx.eu, or a Wi-Fi sign-in screen has interrupted the connection. Your information is still secure because Vivaldi stopped the connection before any data was exchanged.

You cannot visit xxxxxxxx.eu right now because the website uses HSTS. Network errors and attacks are usually temporary, so this page will probably work later.*

This SUCKS!!!!

The browser is a tool and a tool should do thing the user wants and not what the tool wants!
Its ok to warn if something is smelly, but I as the user should have the final decision what to do.

I dont want to say that I can open MY OWN SITE with other browser, but its working.
Blocking me from sites I want to visit makes this tool/browser unusuable.

How can I ignore this superfluous, indispensable message?

Do you want me to change to another browser? You´re on the best way!

[LonM]

1. It mentions HSTS. The point of HSTS is that it forces an HTTPS connection. Your site shouldn't be on the HSTS preload list if this is not the case.

Otherwise, this is HSTS working exactly as intended. And example of why you might want this is to prevent someone using a Downgrade Attack

2. You can usually get past these warnings by clicking "Advanced" and then "Proceed":

[logg.sar]

No sir, this option isn´t available...

@gwen-dragon said in To much alleged security:

You misunderstand the security concept. Your router or your website sends wrong SSL related security information to the browser.
The browser complains, that is not Vivaldi's fault.

NO.
The browser doesn´t complain - the browser blocks!

BTW - neither the router nor the website are sending wrong security information. The certificate run out yesterday and I know it and can hadle it and can live with it. In case my tool allows me to see it.

If I could override it (without hidden abracadabra) - like in the screenshot LonM posted it would be ok.

But this browser BLOCKS.
A tool wich wants to educate is basically wrong!

[LonM]

@logg-sar A feq questions:

• Did you put your site on an HSTS preload list?
• Did you send a header forcing an HSTS to be on?
• Have you tried just getting a free certificate from https://letsencrypt.org/ in the meantime?

[Pesala]

If the user complains, this is not Vivaldi's fault.

Did you try the tip given by Gwen to bipass the security blocking.

thisisunsafe

[logg.sar]

@lonm said in To much alleged security:

@logg-sar A feq questions:

• Did you put your site on an HSTS preload list?
• Did you send a header forcing an HSTS to be on?
• Have you tried just getting a free certificate from https://letsencrypt.org/ in the meantime?

Yes, it could reconfigure Apache, order a new certificate (regardless of costs or not)

This would meen I should bend my site (maybe the complete internet) just to get vivaldi to work?

Does it make sense?

[logg.sar]

@pesala said in To much alleged security:

If the user complains, this is not Vivaldi's fault.

Did you try the tip given by Gwen to bipass the security blocking.

thisisunsafe

Oh, interesting.

I translate this to "Vivaldi is always right and if the user complains the user is wrong."

Interesting point of view.

I always taught a tool like a browser should work for the user and not the user should adapt to the browser.
Also interesting is that every other browser I tried (Chrome, IE, Opera) do warn but allow access. Only vivaldi not.
Probably they are all wrong.

[Pesala]

@logg-sar said in To much alleged security:

I translate this to "Vivaldi is always right and if the user complains the user is wrong."

Then you're wrong. You did not translate it, but misinterpreted it to suit your own prejudices.

You are wrong to vent your frustration here. Other users have given their free time to help you, but you won't listen. Therefore you are wrong.

If a feature is missing, first search the Feature Requests forum, then vote for it, or post a new one if it does not exist. Complaining is useless when things do not work as you would like. Asking for help, using workarounds, or suggesting improvements is the right way to respond.

[Pesala]

Vote for the existing feature request: A Few Missing Privacy/Security Options

Enough information was given already, so thread closed.

[logg.sar]

@pesala

well - the link Gwen posted helped.
This means its the browser configuration. No need for a request.

Unfortunately I couldnt quote her posting because I got the message Post content was flagged as spam by Akismet.com Even more alleged security...

And yes. I was frustrated. Because I couldn´t access my site with one of four browsers.
And yes. It turned out it was a configuration error in the browser. BTW: not configured by me. At least non known.
And yes. I do appreciate your time and your answers.
BUT: if you watch the thread I should reconfigure my web-server, install a new certificate, search the mistake on my side - only Gwen provided a helpful link.

However - its late now and I have to go.

@Gwen-Dragon Danke für die Zeit