Skip to content

Instantly share code, notes, and snippets.

@SteffenGivard
Last active February 18, 2021 13:13
Show Gist options
  • Select an option

  • Save SteffenGivard/b7a3b8134be1fb50ed173c077a47d3a0 to your computer and use it in GitHub Desktop.

Select an option

Save SteffenGivard/b7a3b8134be1fb50ed173c077a47d3a0 to your computer and use it in GitHub Desktop.
A little sneaky trick to easily bypass Google Chrome's "Your connection is not private" warning using a secret keyword.

Easily bypass Chromes "Your connection is not private" warning

When Chrome warns you, that your connection is not private, when fx visiting a development environment, you can easily bypass the warning. While on the warning page, simply just type thisisnotsafe on your keyboard, and the site will continue to load.

The warning reads as follows.

Attackers might be trying to steal your information from 192.168.0.1 (for example, passwords, messages or credit cards).

NET::ERR_CERT_AUTHORITY_INVALID

Use wisely

Needless to say use of this "feature" is a bad idea and is unsafe — hence the name.

This "feature" should only be used on local or development environments.

You should find out why the site is showing the error and/or stop using it until they fix it. HSTS specifically adds protections for bad certificates to prevent you clicking through them. The fact it's needed suggests there is something wrong with the https connection — like the site or your connection to it has been hacked.

Changes periodically

The Chrome developers also do change this periodically. They changed it recently from badidea to thisisunsafe, so everyone using badidea suddenly stopped being able to use it. You should not depend on it.

However, it is available in the code. Should it change again, though, they now base64 encode it to make it more obscure. The last time they changed it, they put this comment in the commit:

Rotate the interstitial bypass keyword

The security interstitial bypass keyword hasn't changed in two years and awareness of the bypass has been increased in blogs and social media. Rotate the keyword to help prevent misuse.

Reset warning

If you've proceeded past the warning for a site, and would like to re-enable security warnings for that site again, you have to click on the padlock to reset it (so you can type it again).

screenshot

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment