Bypassing Browser Security Warnings with Pseudo Password Fields
I just realized: This site was never over HTTPS. It was an HTTP site, and the browser had a regression that broke the site&#x27;s user functionality.<p>Troy Hunt is attempting to claim this is a <i>feature</i> and not a bug, and that their workaround is &quot;being deceptive&quot;, when they <i>never claimed it was secure to begin with</i>.<p>The browser is literally pushing an idealistic philosophy down websites&#x27; throats and basically doing damage to businesses and brands without an attempt to help them, and any attempts to simply keep old functionality are being vilified as &quot;anti-vaxers&quot;. This is not an honest narrative.<p>Yes, Oil and Gas International had an insecure site, and yes, their reaction and demand to the browser vendor was inappropriate. But the point of it is still valid: as a vendor, you don&#x27;t embarrass and damage business reputations in order to force them to comply with the way you would <i>like</i> them to run their sites.<p>Troy writes in the article that browser vendors are trying to use a &quot;lever&quot; to &quot;force organizations to go secure&quot;. I don&#x27;t care who you are, it&#x27;s wrong to force anyone to do anything they don&#x27;t want to do, and on your timeline instead of theirs, and with absolutely no help given to them before this deadline.<p>Imagine if Microsoft changed their OS to flag every single application as &quot;insecure&quot; if it doesn&#x27;t implement a new primitive, and they pushed this out today. All of a sudden, you receive a barrage of calls from upset users. You didn&#x27;t know they were going to push that out (certainly Microsoft never sent you an e-mail), and you now have to hit the ground running trying to figure out how to add those primitives to your code, test them, and release them, none of which could possibly happen immediately, and may take weeks of development. Meanwhile, your reputation with your users is damaged, and users themselves go through emotional stress and fear. And Microsoft&#x27;s response? &quot;Too bad. You should have been secure already.&quot;<p>This is fucked up. And if Google does this knowing it&#x27;s going to damage businesses, they could face a class-action lawsuit.<p>The only way they get away with it is because they have the biggest market share. If Chrome had a smaller user base, businesses would simply shut off access to Chrome browsers and tell them their browsers were faulty and to switch to IE. This is impressively tyrannical behavior for a software vendor, and Google is indeed being a bully.