Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome 56 will mark HTTP pages with password fields as non-secure

security.googleblog.com

Post reply on HN
Print view View original

131–140 of 419 posts

Re: Chrome 56 will mark HTTP pages with password fields as non-secure

#131

Post by techwizrd »

johndoe4589 wrote: post #126
caconym_ wrote: post #106

Earlier quoted context omitted.

I am not a security expert, but as I understand it, passwords sent in the clear are vulnerable to being intercepted. Even if users of your site don't have much to worry about from those accounts being compromised (this may or may not be true), lots of people use the same password for more than one login, so their accounts on other sites could be compromised too. That's definitely a significant security risk, even if…

I know I guess I just have to vent some frustration. Time to move on I guess. Does anyone have good hosting suggestions for a web app that has a 1GB database and a few thousand active users? I can only afford ~10-20 EUR a month on shared hosting atm.

Have you tried Amazon Lightsail or Digital Ocean? Both of them give you more than a paltry 1 GB for their $5/mo plans.

Re: Chrome 56 will mark HTTP pages with password fields as non-secure

#132

Post by waskosky »

clamprecht wrote: post #111

What if the submits to an https page but the page is served up on an http page? The form submission will be secure, correct? Will Chrome still mark as insecure?

Technically it would be possible to use JavaScript to intercept the onSubmit event of such a form, and alter the submission location or send the data insecurely wherever you want with AJAX, completely ignoring the destination action that came with the initial HTML. This is one of the reasons people have needed to use forms within secure iFrames to circumvent PCI Compliance requirements when sending credit card numbers.

Re: Chrome 56 will mark HTTP pages with password fields as non-secure

#133

Post by lucideer »

johndoe4589 wrote: post #120
oh_sigh wrote: post #105

Earlier quoted context omitted.

Why do you have a password field on a http site?

Like every other person who started a forum some years ago or a wordpress blog you mean? Do you think web hosts offer SSL by default? NO they don't. Duh. That's what is annoying in these comments. Everyone seems to shrug like SSL is standard feature nowadays, except is isn't.

That's the point. SSL/TLS is a standard feature nowadays. If you're a web host and you don't support certs or charge some unreasonable fee for adding them (and I'm well aware there are far too many of these out there), then you need to be losing business fast. Your customers should be moving to better competitors. This measure just accelerates this process.

Re: Chrome 56 will mark HTTP pages with password fields as non-secure

#134

Post by ycitm »

johndoe4589 wrote: post #126
caconym_ wrote: post #106

Earlier quoted context omitted.

I am not a security expert, but as I understand it, passwords sent in the clear are vulnerable to being intercepted. Even if users of your site don't have much to worry about from those accounts being compromised (this may or may not be true), lots of people use the same password for more than one login, so their accounts on other sites could be compromised too. That's definitely a significant security risk, even if…

I know I guess I just have to vent some frustration. Time to move on I guess. Does anyone have good hosting suggestions for a web app that has a 1GB database and a few thousand active users? I can only afford ~10-20 EUR a month on shared hosting atm.

If you have control of your nameservers you can use cloudflare's free TLS offering and keep your current webhost.

Re: Chrome 56 will mark HTTP pages with password fields as non-secure

#135

Post by fastball »

johndoe4589 wrote: post #126
caconym_ wrote: post #106

Earlier quoted context omitted.

I am not a security expert, but as I understand it, passwords sent in the clear are vulnerable to being intercepted. Even if users of your site don't have much to worry about from those accounts being compromised (this may or may not be true), lots of people use the same password for more than one login, so their accounts on other sites could be compromised too. That's definitely a significant security risk, even if…

I know I guess I just have to vent some frustration. Time to move on I guess. Does anyone have good hosting suggestions for a web app that has a 1GB database and a few thousand active users? I can only afford ~10-20 EUR a month on shared hosting atm.

You have a few thousand active monthly users (since it's a web app that requires an account, I'm assuming that corresponds to 50-100k page views per month) and you can't recoup 10-20 EUR a month to cover server costs?

I think it's time for a bit of light monetization.

Re: Chrome 56 will mark HTTP pages with password fields as non-secure

#136

Post by lucideer »

johndoe4589 wrote: post #126
caconym_ wrote: post #106

Earlier quoted context omitted.

I am not a security expert, but as I understand it, passwords sent in the clear are vulnerable to being intercepted. Even if users of your site don't have much to worry about from those accounts being compromised (this may or may not be true), lots of people use the same password for more than one login, so their accounts on other sites could be compromised too. That's definitely a significant security risk, even if…

I know I guess I just have to vent some frustration. Time to move on I guess. Does anyone have good hosting suggestions for a web app that has a 1GB database and a few thousand active users? I can only afford ~10-20 EUR a month on shared hosting atm.

I'm currently on OVH. If you've a tight budget, I'd highly recommend. They're a LetsEncrypt sponsor so they offer free SSL out of the box https://www.ovh.ie/news/articles/a2224.ovh-your-free-ssl-cer...

Re: Chrome 56 will mark HTTP pages with password fields as non-secure

#137

Post by fastball »

techwizrd wrote: post #131
johndoe4589 wrote: post #126

Earlier quoted context omitted.

I know I guess I just have to vent some frustration. Time to move on I guess. Does anyone have good hosting suggestions for a web app that has a 1GB database and a few thousand active users? I can only afford ~10-20 EUR a month on shared hosting atm.

Have you tried Amazon Lightsail or Digital Ocean? Both of them give you more than a paltry 1 GB for their $5/mo plans.

Seconding DigitalOcean. You can get a 20GB SSD + 1000GB xfer for $5 a month.

Re: Chrome 56 will mark HTTP pages with password fields as non-secure

#138

Post by IanCal »

johndoe4589 wrote: post #95
lucideer wrote: post #4

Firefox has started to do this recently and it's been fantastically informative and helpful. It's the one new browser feature I never really considered wanting/needing before, that's really stood out to me as being incredibly valuable since I've started to see the warnings pop up.

Kinda like how your antivirus tells you about how the formidable threats it saved your ass from today? Or like "did you know your house COULD have been ransacked today, but it didn't happen!!" Now all my users are going to hear that my site is insecure, when nothing at all changed. How long ago did they announce that? I think just a couple months? They should have announced this much sooner. It's going to hit me hard…

> Now all my users are going to hear that my site is insecure, when nothing at all changed.

Correct, nothing has changed, it has always been insecure.

Re: Chrome 56 will mark HTTP pages with password fields as non-secure

#139

Post by tomschlick »

dawnerd wrote: post #117
throwaway6845 wrote: post #89

Countdown until a JS extension that takes a normal field and uses • characters to make it look like a password field without tripping Chrome's detector...

Can we just ban inputs being manipulated on input? It's really annoying for custom implemented types like phone numbers that do the '(___) ___-____'. Half the time it seems they break if you mess up.

I'd be in favor of banning input manipulation but adding custom fields like phone which would accept regex formatters.

Re: Chrome 56 will mark HTTP pages with password fields as non-secure

#140

Post by robbiewxyz »

johndoe4589 wrote: post #126
caconym_ wrote: post #106

Earlier quoted context omitted.

I am not a security expert, but as I understand it, passwords sent in the clear are vulnerable to being intercepted. Even if users of your site don't have much to worry about from those accounts being compromised (this may or may not be true), lots of people use the same password for more than one login, so their accounts on other sites could be compromised too. That's definitely a significant security risk, even if…

I know I guess I just have to vent some frustration. Time to move on I guess. Does anyone have good hosting suggestions for a web app that has a 1GB database and a few thousand active users? I can only afford ~10-20 EUR a month on shared hosting atm.

I think you could probably just point your DNS at Cloudflare to proxy your site through them; their service includes SSL plus some extras like caching and such for free. I've used them for a handful of projects and it's worked great.
Post reply on HN