Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Please make the removal page more scary/realistic #153

Open
6 tasks
Darkspirit opened this issue May 31, 2018 · 1 comment
Open
6 tasks

Please make the removal page more scary/realistic #153

Darkspirit opened this issue May 31, 2018 · 1 comment

Comments

@Darkspirit
Copy link

Darkspirit commented May 31, 2018

  • I understand that switchting back to http:// would be a violation against Article 32 EU GDPR.
  • I understand that removing my domain from the HSTS preloading list would make me and my users more likely vulnerable to downgrade attacks and I confirm my liability about this.
  • I am aware that intelligence agencies intercept internet traffic and may even do full takes of certain protocols.
  • I am aware that anybody can find out this bad action and that this may lead to bad press.
  • Yes, I am too incompetent to find another solution for my problem.
  • Yes, I really want to remove my domain from the list.
@lgarron
Copy link
Collaborator

lgarron commented Jun 1, 2018

I appreciate the enthusiasm!

Although there are stronger incentives for HTTPS, my impression is that a scarier checklist will not necessarily help discourage the kinds of removal requests we see: https://crbug.com/527947

We should also not overstate things: Article 32 of the GDPR says security should be "appropriate to the risk", bad press purely due to lack of preload HSTS is actually a fairly low risk for the kinds of sites that ask for removal, and we should not be condescending to site operators who are often making a frustrating tradeoff already.

Also note that the removal form right now purposely has no checkboxes. If we add some stronger language, I think it would be better to add it to the page directly.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants