Firefox has a similar feature enabled in dev edition: https://blog.mozilla.org/security/2017/01/20/communicating-t...
Actually, it's in Beta now, and will be shipping to Firefox release channel users on Monday or Tuesday.
Chrome 56 will mark HTTP pages with password fields as non-secure
141–150 of 419 posts
Re: Chrome 56 will mark HTTP pages with password fields as non-secure
#142I hope they do this for CC numbers too, because I know of a website I had to use that passed your Name, address, CC number, CC exp, amount; the whole shebang over plain ol' http to do a payment shudder .
Honest question, who is in a position to tap your connection such that this becomes a serious security concern? IT staff at your company? The admins at your ISP? The NSA? I'm assuming that public wifi has session-specific encryption keys. I don't see these as the kinds of concerns that would warrant the kind of panic that some people seem to show over HTTP.
HTTPS isn't just about encryption either. It's about authentication and integrity as well.
Making sure the server you are talking to is the correct one, and making sure that nobody along the way injects ads, trackers, malware, or anything else.
Re: Chrome 56 will mark HTTP pages with password fields as non-secure
#143I've been paying rent with www.rentpayment.com which unfortunately serves up their home page with multiple logins over http. Naturally, emails and tweets to their support go ignored. Maybe they'll finally respond after more people ask them why they're "non-secure".
Re: Chrome 56 will mark HTTP pages with password fields as non-secure
#144Earlier quoted context omitted.
Why do you have a password field on a http site?
Like every other person who started a forum some years ago or a wordpress blog you mean? Do you think web hosts offer SSL by default? NO they don't. Duh. That's what is annoying in these comments. Everyone seems to shrug like SSL is standard feature nowadays, except is isn't.
Err, I work for a web host and we offer SSL by default as part of the onboarding. Speak for yourself :).
Re: Chrome 56 will mark HTTP pages with password fields as non-secure
#145Earlier quoted context omitted.
I am not a security expert, but as I understand it, passwords sent in the clear are vulnerable to being intercepted. Even if users of your site don't have much to worry about from those accounts being compromised (this may or may not be true), lots of people use the same password for more than one login, so their accounts on other sites could be compromised too. That's definitely a significant security risk, even if…
I know I guess I just have to vent some frustration. Time to move on I guess. Does anyone have good hosting suggestions for a web app that has a 1GB database and a few thousand active users? I can only afford ~10-20 EUR a month on shared hosting atm.
Try OVH. $3.5/mo for a 2GB RAM VPS
https://www.ovh.com/us/vps/
Re: Chrome 56 will mark HTTP pages with password fields as non-secure
#146Earlier quoted context omitted.
Well, that is the whole point I'm trying to make. Why does chrome think I'm using a password on the page when there is no password? Anyway, Chrome will mark all http as insecure sooner or later so will just have to force https on all connections... There seems to be many people with similar problems of false positives for nonexistant passwords so I guess it's a bug.
I haven't heard of this bug, but regarding the decision to mark all HTTP as insecure: Remember, HTTPS isn't just for security, but also privacy. And even if your site is such that there is no privacy advantage in hiding the exact URL you visited (as opposed to the hostname, which unfortunately must leak for now), even if there are no cookies sent to your site, or to any iframes it uses, which can be used for identifi…
> Remember, HTTPS isn't just for security, but also privacy.
And the third thing: authenticity.
No-one has modified the page, for example to insert or change advertisements
Re: Chrome 56 will mark HTTP pages with password fields as non-secure
#147Earlier quoted context omitted.
My colleague used a custom web font where every glyph was replaced with a filled circle. Better browser compatibility, you know. Although our reason was actually to do with password managers. At $DAYJOB we have a CRM/ERP system with lots of password fields for other entities (not the current cookie user). It's increasingly difficult to opt out of browser autofill, and LastPass in particular was corrupting password da…
> It's increasingly difficult to opt out of browser autofill Good. I hope browsers autodetect these web font tricks and pop up similar warnings. I can't stand when some random website make thinks it can do a better job of credential security than major browser makers.
I think the point is more like an HR administrator who opens a web page, containing an employee's details. They need to update the employee's home phone number, but their password manager dumps the HR administrator's password into the "Set new password" field, which is therefore overwritten.
Re: Chrome 56 will mark HTTP pages with password fields as non-secure
#148Earlier quoted context omitted.
Why do you have a password field on a http site?
Like every other person who started a forum some years ago or a wordpress blog you mean? Do you think web hosts offer SSL by default? NO they don't. Duh. That's what is annoying in these comments. Everyone seems to shrug like SSL is standard feature nowadays, except is isn't.
You're leaving your users vulnerable because you can't be bothered to do things correctly. You are not the wronged party here, they are, and you're just finally being pushed into doing it right.
Re: Chrome 56 will mark HTTP pages with password fields as non-secure
#149Earlier quoted context omitted.
I know I guess I just have to vent some frustration. Time to move on I guess. Does anyone have good hosting suggestions for a web app that has a 1GB database and a few thousand active users? I can only afford ~10-20 EUR a month on shared hosting atm.
I think you could probably just point your DNS at Cloudflare to proxy your site through them; their service includes SSL plus some extras like caching and such for free. I've used them for a handful of projects and it's worked great.
That said it will still be insecure because of the unencrypted path from cloudflare to you server but it will hire the error
Re: Chrome 56 will mark HTTP pages with password fields as non-secure
#150I hope they do this for CC numbers too, because I know of a website I had to use that passed your Name, address, CC number, CC exp, amount; the whole shebang over plain ol' http to do a payment shudder .
Honest question, who is in a position to tap your connection such that this becomes a serious security concern? IT staff at your company? The admins at your ISP? The NSA? I'm assuming that public wifi has session-specific encryption keys. I don't see these as the kinds of concerns that would warrant the kind of panic that some people seem to show over HTTP.
Your assumption about public wifi is wrong. If you connect without a password, your traffic is sent in the clear and MITM attacks are trivial. If you don't want your password exposed to any hacker with an old Pringles can within a mile of your location, you need end to end crypto.