It's not, the HTTPS site has the HSTS header, so your browser will always redirect to the HTTPS version even if you try the plaintext port. Gotta clear your browser cache, or try another browser.
It allows servers to specify that browsers should never even attempt to make an unencrypted request to the site and instead silently convert any such requests to encrypted requests.
This header is good for security but it’s also convenient for old sites that don’t want to update their existing links. They can upgrade the whole site to HTTPS without any content changes.
That stands for HTTP Strict Transport Security. Its a http header that basically tells your browser to only connect to this website via HTTPS/TLS for a configurable amount of time.
Its a protection mechanism that prevents encryption stripping man-in-the-middle attacks.
Web-browsers are a lot better at auto-filling registration forms correctly thesedays, and now that even Office 365 supports disposable e-mail addresses means that registering for online services is far less of a chore than it was before. Also, many sites support federated identity (OIDC, Sign-in-with-Google, etc) which also takes a lot of the pain away.
I remember in years gone-by, before data/privacy-laws were either introduced or widely understood by web-devs that sites would have all manner of required fields just because someone from marketing or management thinks they need to collect everyones' home address, age, home, work, and mobile phone numbers, and sex/gender - now that they legally can't (without a good reason) things are a lot smoother.
So in summary, BugMeNot is gone because the severity of the problem it aimed to solve (online registration tedium) has been reduced below the threshold of action.
Chrome can actually bypass HSTS if you enter the super secret code in the security warning screen. The code is changed regularly though, you'll have to check chromium source code to get the current bypass code. (e.g. https://chromium.googlesource.com/chromium/src/+/refs/tags/1... )
Very useful for testing but don't make a habit to use it on some random websites.
I was hoping someone would know why it was blocked as malware, thinking it might be compromised and that people should be warned. VT says it's safe though so it's likely a mistake. Not sure what you mean about traceability. You could check the github.
Never understood why people use it seems to be too risky.
You can end up sharing an account with someone associated with some unsavory activity and end up having to explain it.
Plus many sites allow users to view their login and download activity logs which means your private information can leak that way.
Sure VPNs and TORs can help mitigate some of that risk but BMN isn’t for opsec it’s for continence if you already are taking extra steps for opsec you might as well use disposable email addresses for your disposable accounts.
I only ever used it to access things that should not have been behind a user account in the first place. It was really just an opt out for the forced "sign up for our newsletter/spam to download our app" type paths. The only thing it'd really leak is that someone with a particular IP had used bugmenot... Which many would likely consider an advantage over going through creating an account and potentially getting spammed.
I rely on email proxy for most stuff nowadays, so when I register an account I can at least temporarily disable the address used for this particular service if it gets too spammy.
Combined with a password manager it's mostly the only way to stay sane online.
It doesn’t matter you use it to access a news article someone else uses it to issue a death threat as a joke or do something worse your IP is tagged on the same account and someone might come knocking.
Law enforcement isn’t even likely to know that the account is on BMN or even what it is. And what’s worse is if the rest of the IPs are foreign but you are local well congrats you’ve now become the focus simply for being within reach.
That sure is a bunch of fearmongery. With how mobile everyone is these days an account can be logged into by hundreds of IPs, including residential IPs like friends and family. It's not a very significant data point for law enforcement unless they can find any actual dirt through that.
I created several BugMeNot accounts over the years without any issues. I guess if any of them got used for unsavory stuff it would be pretty clear from the logs that the account was shared.
