SSL certificate and HSTS bypass with keyword (thisisunsafe)

[RixzZ]

Chromium based browsers, for a long time, have had this feature where you can bypass invalid SSL certificates, including ones where HSTS is enabled (be that because is on a preload list or you accessed it before with a valid cert).

This is very useful on development workflows and is something that was discussed with the Firefox team, but never was implemented for various reasons. Some examples:

• https://connect.mozilla.org/t5/ideas/allow-firefox-to-bypass-hsts-errors/idi-p/163
• https://bugzilla.mozilla.org/show_bug.cgi?id=1528738

I'm aware that Firefox offers some alternatives to this, most of them discussed before, but the main differences are that those options either are persistent config changes that you later would need to rollback to return to the normal browsing or require a restart to make them work.

The keywork approach allows you to bypass that only for the current interaction, which is really useful.