Ask HN: Any plan to prevent connection to heartbleed vulnerable site by default?
It would be nice if my web browser would prevent me from going on any site with a vulnerable version of OpenSSL, the same way a warning is displayed when a certificate is not valid as it would prevent people from thinking their connection is secured while it is absolutely not.
Also, it would be nice to prevent connection to any site with a certificate that was not generated after the exploit was made public (maybe except if it is in some whitelist for websites that we are sure never used a bad version of OpenSSL).
I guess it would be possible to do so using a browser extension (anyone working on that?) but it would be even nicer to have it built-in in every web browser to protect everyone even non tech people. So if anyone from the Chrome or Firefox team is reading this, it would be awesome to do that ! It would be a big step forward protecting us from incompetent sys admin.
1 comments
I've also suggested the same and posted a feature request to Chromium Bugs (do not do the same, I'm sure they receive more than once this feature request). I hope this gets implemented in all major browser.