"Your connection is not private" should allow a workaround #14216

097115 · 2021-02-17T10:02:21Z

Description

When encountering a privacy error, a user should be allowed to proceed anyway. May be this option to allow proceeding should be first enabled in settings or flags but it still must exist.

Brave:
https://i.imgur.com/pdYLL8x.png

Firefox:
https://i.imgur.com/GFYbrmg.png

Version info:

Brave | 1.20.103 Chromium: 88.0.4324.152 (Official Build) (x86_64)
Revision | 6579930fc53b4dc589c042bec9d0a3778326974d-refs/branch-heads/4324@{#2106}
OS | OS X Version 10.11.6 (Build 15G22010)

ryanbr · 2021-02-18T08:27:00Z

The warning in Brave is the same warning message is in Chrome. Not sure if we need to change it. (Testing the example https://flibusta.is/)

@097115

097115 · 2021-02-18T08:31:02Z

@ryanbr Thanks for your reply!

Unfortunately, don't have Chrome installed. But are you telling that with Chrome you really can't proceed to such sites, too? I mean, it's sort of embarrassing for a user being unable to make their educated choice.

ryanbr · 2021-02-18T10:29:28Z

How could the error message be improved, maybe a sample screenshot?

097115 · 2021-02-18T11:48:06Z

@ryanbr Didn't I provide one? :)

On the Firefox pic you can notice that despite having an error, you can still proceed to the website. Yes, there will be possible risks but they are on you and you are taking your educated decision.

Until recently, Brave (and Chrome) had the same opportunity. Now, Brave just informs the user about the error, and there's nothing one can do, users simply are forced to obey.

ryanbr · 2021-02-19T11:53:37Z

When encountering a privacy error, a user should be allowed to proceed anyway. May be this option to allow proceeding should be first enabled in settings or flags but it still must exist.

You can proceed, there is a link provided. Clicking on Advanced button then clicking on Proceed to....(url) The only real difference between Brave and Firefox here, is Firefox will use a button and we use a text link.

097115 · 2021-02-19T12:41:07Z

@ryanbr

But I don't have this Proceed to flibusta.is (unsafe) link! I swear :) (And yes, it's exactly what I'm looking for.)

Here's another pic, and note that the scrollbar is at the very bottom, there's nothing more there:

Version 1.20.103 Chromium: 88.0.4324.152 (Official Build) (x86_64) (and it says it's up to date).

097115 · 2021-02-22T10:13:04Z

@ryanbr

As of version 1.20.108 Chromium: 88.0.4324.182 (Official Build) (x86_64), it's still has no Proceed to....(url) link.

@rebron

No, it doesn't repros for me on Chrome, since Chrome seems to have this link:

So, it would be great if you guys indeed could update/check your Brave, and confirm this issue.

alinposho · 2021-02-24T13:32:19Z

+1 to getting this fixed: I too do not have the option to Proceed to ... (unsafe) link in the Advanced section.

Version Info

Brave Version 1.20.108 Chromium: 88.0.4324.182 (Official Build) (64-bit)
OS: Linux Mint 20 Cinnamon 4.6.7, Linux Kernel: 5.4.0-66-generic

097115 · 2021-02-28T09:12:06Z

@ryanbr

I've just noticed that the same URL (same search request) returns different errors in Normal and Private (without Tor) windows. And Private indeed has the proceed to link, while Normal still doesn't (Version 1.20.110 Chromium: 88.0.4324.192 (Official Build) (x86_64))

Normal:

Private:

So, may be that's the culprit then?

rebron · 2021-05-07T21:41:12Z

https://flibusta.is/ Seems to have their cert error resolved.

Need to verify if this is still an issue with this error interstitial with another example.

rebron · 2021-05-14T19:02:32Z

Closing. Please re-open if still not seeing the links to proceed.

Links do appear in Normal window. Tested on latest release channel.

Brave	1.24.85 Chromium: 90.0.4430.212 (Official Build) (arm64)
Revision	e3cd97fc771b893b7fd1879196d1215b622c2bed-refs/branch-heads/4430@{#1429}
OS	macOS Version 11.3 (Build 20E232)

knightian · 2021-05-22T08:30:42Z

Please reopen,

When we access something hosting with self signed certificates, so for example an OpenWRT router or any consumer modem/routers web GUI accessed over HTTPS, Brave does not allow for me to proceed past the warning.

I have to switch to use literally any other browser except Brave to login and configure settings on the router etc.

It would appear that ERR_CERT_INVALID error is trying to be overly zealous about not letting the user continue on to an "unsafe" site. For public IP or FQDN this would make sense, but I think you should have a sanity check for private IPs and allow such proceeding on a private IP range. What happens currently is really stupid because it locks anyone out from trying to configure their modem or any such thing as that. DUMB!

Screenshot attached:

Here you can see it working fine in Firefox:

And here is the certificate for your reference:

Subject: OpenWrt

Issuer: OpenWrt

Expires on: 22 May 2023

Current date: 22 May 2021

PEM encoded chain:
-----BEGIN CERTIFICATE-----
MIIDjTCCAnWgAwIBAgIIDqeh7VNb5LgwDQYJKoZIhvcNAQELBQAwXzELMAkGA1UE
BhMCWloxEjAQBgNVBAgMCVNvbWV3aGVyZTEQMA4GA1UEBwwHVW5rbm93bjEYMBYG
A1UECgwPT3BlbldydDg0ZDcyZTYwMRAwDgYDVQQDDAdPcGVuV3J0MB4XDTIxMDUy
MjAyNTUwOFoXDTIzMDUyMjAyNTUwOFowXzELMAkGA1UEBhMCWloxEjAQBgNVBAgM
CVNvbWV3aGVyZTEQMA4GA1UEBwwHVW5rbm93bjEYMBYGA1UECgwPT3BlbldydDg0
ZDcyZTYwMRAwDgYDVQQDDAdPcGVuV3J0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
MIIBCgKCAQEAiR05sIXPkZnQD4Uozgj3+GsU2Ljs+MKqSmdkLOPts5PZeHMJ/3+i
kOTyf4AkGRv7cKIGwCuBMAF2dFK2HR+evQlwRYv09lImeSTKQvo2MfUAvXZw6t2P
gpLrqsFICNLFTXKCnJdIaEbXfciL2N3wsp0cEuXRP+3UK0lALatyj4mgW+tdkkZr
NRcj9aE4OLEsW08uh6LJZjI4jp5crNFqwJq/EFjn0u8f4XsuQ7FRnLNMB4zA1GU2
hsj8l0wTjTsiFdL0eQC3d0QC2SAyxFeFjoM+o5vtlT+5mRVxGY8dRnQh06gE/vMd
eDg08+WyGJPOkjemkBCDqPADLVwcyjhMpwIDAQABo00wSzAJBgNVHRMEAjAAMB0G
A1UdDgQWBBRWn0IXAbVOf87Z9NDaTZVBGqseZTAfBgNVHSMEGDAWgBRWn0IXAbVO
f87Z9NDaTZVBGqseZTANBgkqhkiG9w0BAQsFAAOCAQEAgqSufbKDMY2bHH++DjFw
nbdQmgencXaBnZFe64/o7uFn8N8UQPh0BZezjTeMLKEoWavxk6aGt2lyMJzsRZ+M
mYyq01qhMIlIifbwWQlcIo/ObxAkL0seQiyDTMlW70oFHAc2POUEuHONo3kxSDzr
IVPfXAlcPai71mKg/Cg6db8wWT0zPq7p9xu8UdfAd3xuBt120trv5MBHw9Ekd2La
uWUKkxHYehKttyi2RG8D32LZ1oIWiUiiWrlMEcvjgsLTu6JNjvgfIJOUpyDltz7J
hYcN0FRmC8JneEqmXwnpoiKW57PPWINkpOZBKfnkpDJDN/VvKVwIxzAuzLDZdidU
rQ==
-----END CERTIFICATE-----

ryanbr · 2021-05-22T12:30:14Z

Does it occur in Chrome also?

knightian · 2021-05-23T01:20:40Z

Does it occur in Chrome also?

Don't use chrome, won't use chrome.

It occurs in Brave, and needs to be fixed in Brave.

ryanbr · 2021-05-23T02:52:20Z

If its a Chrome issue, it should be reported there also. Not saying you permanently need to use Chrome, gives us guidance on how to resolve this.

Probably related: https://bugs.chromium.org/p/chromium/issues/detail?id=1095820

ashtonian · 2021-06-28T06:01:25Z

Please reopen - this happens with self signed certificates. This is crucial for technical workflows, for example I cannot setup my newly installed esxi server through brave.

The error message should also be clearer - in the case of self signed certificates, the connection is indeed encrypted aka private - but it cannot be validated or trusted.

Additionally, site settings -> "display insecure content" has no impact.

ashtonian · 2021-07-15T18:27:16Z

clicking in the window and typing thisisunsafe should work, it adds the site to the exception list

knightian · 2021-07-25T09:16:42Z

clicking in the window and typing thisisunsafe should work adds the site to the exception list

And indeed it does. Thanks!

Pablo-Camara · 2021-10-27T10:32:44Z

The above key worked, but I had no knowledge of it until after I found the solution myself ( I had inspected the page and searched for "ignore" and then on the second occurrence I saw a relevant script there, I copied what was inside the if

  sendCommand(SecurityInterstitialCommandId.CMD_PROCEED);

pasted into the console and it allowed my local website!

But then I came across this last comments ( thank you very much ) and that also works.

HyperCrowd · 2021-11-03T00:48:45Z

clicking in the window and typing thisisunsafe should work, it adds the site to the exception list

Is there any way to make this ridiculously arcane and otherwise impossible-to-discover feature more readily available for web developers somehow?

DeserranoJorden · 2022-03-29T07:31:09Z

This still does not have a workaround....

vvzvlad · 2022-04-18T16:03:10Z

I maintain. I run a lot of docker applications on my server and some of them run on https internally without a domain. It can't get a signed certificate and doesn't need to. But because of the brave browser, I just can't accept that security is now my concern and just work like I can do in chrome, safari and so on. Terrible!!! Fix this!

Nascentes · 2022-07-07T15:16:37Z

Latest release and this is STILL present. I've never seen a "Proceed..." link in the past 3 years of using Brave on my Mac.

Also someone above mentioned that "thisisunsafe" adds a site to a whitelist. That's not accurate. There are 6 or 7 sites I access on a daily basis for work that are "insecure" on the company intranet and every single day for every single one, I am typing "thisisunsafe" to actually get into the site.

How this has been here for at least 3 years is beyond me. Such a QOL fail. Can this be looked at again, please?

https://i.imgur.com/TskNzrP.png (this site I access multiple times a day, every day. All from a normal window. Or from incognito. Shouldn't matter though.)

NiclasPe · 2022-07-25T07:26:11Z

I feel the pain. Im a System-Administrator and want to use my new MacBook Pro with Brave, because its my preferred Browser. But with this Bug, it is not really usable for that.

Im looking forward to hear from the Brave Team to fix it.

ryanbr · 2022-07-25T07:46:04Z

A "fix" like this isn't a Brave issue, should be addressed in chromium. For security we wouldn't override this.

ref: https://bugs.chromium.org/p/chromium/issues/detail?id=1095820

NiclasPe · 2022-07-25T08:03:09Z

A "fix" like this isn't a Brave issue, should be addressed in chromium. For security we wouldn't override this.

ref: https://bugs.chromium.org/p/chromium/issues/detail?id=1095820

OK, thanks for the quick Answer. I will report it there to.

knightian · 2022-07-25T08:18:35Z

I feel the pain. Im a System-Administrator and want to use my new MacBook Pro with Brave, because its my preferred Browser. But with this Bug, it is not really usable for that.

Im looking forward to hear from the Brave Team to fix it.

The “thisisunsafe” command allows us to override and is an acceptable workaround in my opinion. I think that the “thisisunsafe” command does need to be made known to the user better then it is today however.

NiclasPe · 2022-07-25T08:36:24Z

I feel the pain. Im a System-Administrator and want to use my new MacBook Pro with Brave, because its my preferred Browser. But with this Bug, it is not really usable for that.
Im looking forward to hear from the Brave Team to fix it.

The “thisisunsafe” command allows us to override and is an acceptable workaround in my opinion. I think that the “thisisunsafe” command does need to be made known to the user better then it is today however.

Did I have to write this on my keyboard or in the browser console?

knightian · 2022-07-25T09:02:51Z

I feel the pain. Im a System-Administrator and want to use my new MacBook Pro with Brave, because its my preferred Browser. But with this Bug, it is not really usable for that.
Im looking forward to hear from the Brave Team to fix it.

The “thisisunsafe” command allows us to override and is an acceptable workaround in my opinion. I think that the “thisisunsafe” command does need to be made known to the user better then it is today however.

Did I have to write this on my keyboard or in the browser console?

Click the page and just type "thisisunsafe" you won't see it typing the characters anywhere but it auto detects it and proceeds to the site.

I'm also on a mac, this command is a saviour ;)

vvzvlad · 2022-07-25T12:08:27Z

For security we wouldn't override this.

Adding a "go anyway" button, as it was in the original version before the chromium team fixed it, does not affect security in any way: the user is still shown a message about an invalid certificate, they just stop being forced to write weird spells in the browser console. All you need to do is add a "go anyway, I understand the risks" button

NiclasPe · 2022-07-25T15:14:10Z

Since i try this Tipp, the button appears on my Mac.
Thanks for help!

The above key worked, but I had no knowledge of it until after I found the solution myself ( I had inspected the page and searched for "ignore" and then on the second occurrence I saw a relevant script there, I copied what was inside the if
  sendCommand(SecurityInterstitialCommandId.CMD_PROCEED);
pasted into the console and it allowed my local website!

But then I came across this last comments ( thank you very much ) and that also works.

Dedger · 2023-02-28T14:14:27Z

Hello, I have found an alternative approach to downloading the file
Actualy, I just copy the download link and send it to my telegram "Saved massage". After this action, I see the following situation:

097115 added the OS/Desktop label Feb 17, 2021

rebron added the repros-on-chrome label Feb 19, 2021

rebron removed the repros-on-chrome label May 7, 2021

rebron closed this as completed May 14, 2021

rebron added the closed/works-for-me label May 14, 2021

097115 mentioned this issue May 31, 2021

"Your clock is ahead" interstitial should allow a way to proceed #16151

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

"Your connection is not private" should allow a workaround #14216

"Your connection is not private" should allow a workaround #14216

097115 commented Feb 17, 2021

ryanbr commented Feb 18, 2021

097115 commented Feb 18, 2021

ryanbr commented Feb 18, 2021

097115 commented Feb 18, 2021

ryanbr commented Feb 19, 2021

097115 commented Feb 19, 2021

097115 commented Feb 22, 2021

alinposho commented Feb 24, 2021

097115 commented Feb 28, 2021 •

edited

Loading

rebron commented May 7, 2021

rebron commented May 14, 2021

knightian commented May 22, 2021 •

edited

Loading

ryanbr commented May 22, 2021

knightian commented May 23, 2021

ryanbr commented May 23, 2021 •

edited

Loading

ashtonian commented Jun 28, 2021

ashtonian commented Jul 15, 2021 •

edited

Loading

knightian commented Jul 25, 2021

Pablo-Camara commented Oct 27, 2021

HyperCrowd commented Nov 3, 2021

DeserranoJorden commented Mar 29, 2022

vvzvlad commented Apr 18, 2022

Nascentes commented Jul 7, 2022 •

edited

Loading

NiclasPe commented Jul 25, 2022

ryanbr commented Jul 25, 2022

NiclasPe commented Jul 25, 2022 •

edited

Loading

knightian commented Jul 25, 2022

NiclasPe commented Jul 25, 2022

knightian commented Jul 25, 2022 •

edited

Loading

vvzvlad commented Jul 25, 2022

NiclasPe commented Jul 25, 2022

Dedger commented Feb 28, 2023

"Your connection is not private" should allow a workaround #14216

"Your connection is not private" should allow a workaround #14216

Comments

097115 commented Feb 17, 2021

Description

Version info:

ryanbr commented Feb 18, 2021

097115 commented Feb 18, 2021

ryanbr commented Feb 18, 2021

097115 commented Feb 18, 2021

ryanbr commented Feb 19, 2021

097115 commented Feb 19, 2021

097115 commented Feb 22, 2021

alinposho commented Feb 24, 2021

Version Info

097115 commented Feb 28, 2021 • edited Loading

rebron commented May 7, 2021

rebron commented May 14, 2021

knightian commented May 22, 2021 • edited Loading

ryanbr commented May 22, 2021

knightian commented May 23, 2021

ryanbr commented May 23, 2021 • edited Loading

ashtonian commented Jun 28, 2021

ashtonian commented Jul 15, 2021 • edited Loading

knightian commented Jul 25, 2021

Pablo-Camara commented Oct 27, 2021

HyperCrowd commented Nov 3, 2021

DeserranoJorden commented Mar 29, 2022

vvzvlad commented Apr 18, 2022

Nascentes commented Jul 7, 2022 • edited Loading

NiclasPe commented Jul 25, 2022

ryanbr commented Jul 25, 2022

NiclasPe commented Jul 25, 2022 • edited Loading

knightian commented Jul 25, 2022

NiclasPe commented Jul 25, 2022

knightian commented Jul 25, 2022 • edited Loading

vvzvlad commented Jul 25, 2022

NiclasPe commented Jul 25, 2022

Dedger commented Feb 28, 2023

097115 commented Feb 28, 2021 •

edited

Loading

knightian commented May 22, 2021 •

edited

Loading

ryanbr commented May 23, 2021 •

edited

Loading

ashtonian commented Jul 15, 2021 •

edited

Loading

Nascentes commented Jul 7, 2022 •

edited

Loading

NiclasPe commented Jul 25, 2022 •

edited

Loading

knightian commented Jul 25, 2022 •

edited

Loading