Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome 56 will mark HTTP pages with password fields as non-secure

security.googleblog.com

Post reply on HN
Print view View original

21–30 of 419 posts

Re: Chrome 56 will mark HTTP pages with password fields as non-secure

#22

Post by tptacek »

jbverschoor wrote: post #20
myf01d wrote: post #7

Advancing HTTPS is one of a few good things Google made in the recent years. Thanks Google.

Thanks let's encrypt. Google should've started way way earlier

How early? Put a year on it. What should they have done, and when?

Re: Chrome 56 will mark HTTP pages with password fields as non-secure

#23

Post by brettz »

foota wrote: post #3

Pm - "why is this page insecure" Developer - "chrome labels password fields as insecure over http" Pm - "what if it wasn't a password field"

So accurate. We had this exact discussion. Going to go with insecure warnings until we get https up shortly.

For those wondering you can mask a normal text field in css input { -webkit-text-security: disc; }.

Re: Chrome 56 will mark HTTP pages with password fields as non-secure

#26

Post by skybrian »

guscost wrote: post #11
bsimpson wrote: post #5

Earlier quoted context omitted.

Don't you need to use type = "password" to get the -for-every-character treatment? I suppose you could implement your own (e.g. type = "text" with an onKeyDown listener that cached each keystroke and inserted a into the field), but that sounds like a terrible solution in so many ways. I would think the laziest possible way to workaround this would be to use a CDN like Cloudflare to proxy all traffic to your site. Loo…

> an onKeyDown listener that cached each keystroke and inserted a into the field... sounds like a terrible solution in so many ways. For anyone who is wondering what these ways are, here are a couple: 1) Backspace is a crufty special case 2) What happens when someone highlights text in the input box and types over it?

CodeMirror has figured this out. When you type it's actually into a hidden input, and it updates a separate display.

Reimplementing CodeMirror (including highlighting, etc) is hard enough that most web developers probably can't do it. But it only takes one person to create a library.

Re: Chrome 56 will mark HTTP pages with password fields as non-secure

#27

Post by myf01d »

jbverschoor wrote: post #20
myf01d wrote: post #7

Advancing HTTPS is one of a few good things Google made in the recent years. Thanks Google.

Thanks let's encrypt. Google should've started way way earlier

If Google hasn't threatened people that ranking will sink if they didn't migrate to HTTPS, Let's Encrypt wouldn't have been so popular despite the fact it's free due to the pseudointellecutal SEO "muh performance hit, muh redirect rules" meme

Re: Chrome 56 will mark HTTP pages with password fields as non-secure

#30

Post by brak1 »

paulddraper wrote: post #17
bsimpson wrote: post #5

Earlier quoted context omitted.

Don't you need to use type = "password" to get the -for-every-character treatment? I suppose you could implement your own (e.g. type = "text" with an onKeyDown listener that cached each keystroke and inserted a into the field), but that sounds like a terrible solution in so many ways. I would think the laziest possible way to workaround this would be to use a CDN like Cloudflare to proxy all traffic to your site. Loo…

> onKeyDown Right-click paste from my password manager, and it doesn't work. Thanks. --- This idea is terrible in general, but if you do, against all that is holy, implement it, please, please use onInput.

also type='password' don't get their submitted values suggested for the autocomplete thing in broswers.
Post reply on HN