Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome 56 will mark HTTP pages with password fields as non-secure

security.googleblog.com

Post reply on HN
Print view View original

161–170 of 419 posts

Re: Chrome 56 will mark HTTP pages with password fields as non-secure

#161

Post by wjdp »

michaelmior wrote: post #103
the_duke wrote: post #99

Earlier quoted context omitted.

Right now, you can just put Cloudfront in between. It's free, and takes maybe 5 minutes to sign up and adjust your DNS entries. Of course relying on a provider that might cancel the free plan at any time is not ideal, but worst case you just have to revert your DNS and it's done.

I assume you mean Cloudflare and not Cloudfront. While you could use Cloudfront, AFAIK there's no free option. (Aside from the usage you get as part of the AWS free but that is time-limited.)

AWS Cloudfront isn't free but costs pennies a month if you're not big.

Re: Chrome 56 will mark HTTP pages with password fields as non-secure

#162

Post by derimagia »

malikNF wrote: post #158

This is such a dumb idea on google's part (and mozilla's) because people are now going to program dumb workarounds for this. Google seriously has to stop trying to police the god damn web.

With free ways to encrypt web coming out, you really have no excuse to not use https for login forms. People should be informed.

Re: Chrome 56 will mark HTTP pages with password fields as non-secure

#163

Post by kuschku »

nsgi wrote: post #63
meta_AU wrote: post #24

What should be done for routers and printers that are accessed by their IP address?

The best solution is for them to be accessed through a publicly registered hostname e.g. https://router0123.netgear.com (that would only resolve locally). They could provision certificates for themselves using the Let's Encrypt DNS challenge.

So, now we have a single certificate on all routers? What happens if I take apart a router?

Or would every router get its own certificate? But then netgear would have to become its own CA.

And in either case DNS hijacking is a massive issue.

Re: Chrome 56 will mark HTTP pages with password fields as non-secure

#164

Post by andybak »

johndoe4589 wrote: post #126
caconym_ wrote: post #106

Earlier quoted context omitted.

I am not a security expert, but as I understand it, passwords sent in the clear are vulnerable to being intercepted. Even if users of your site don't have much to worry about from those accounts being compromised (this may or may not be true), lots of people use the same password for more than one login, so their accounts on other sites could be compromised too. That's definitely a significant security risk, even if…

I know I guess I just have to vent some frustration. Time to move on I guess. Does anyone have good hosting suggestions for a web app that has a 1GB database and a few thousand active users? I can only afford ~10-20 EUR a month on shared hosting atm.

Webfaction still rock

Re: Chrome 56 will mark HTTP pages with password fields as non-secure

#165

Post by lostsock »

wfunction wrote: post #160
twblalock wrote: post #156

Earlier quoted context omitted.

> Now all my users are going to hear that my site is insecure, when nothing at all changed. You're being pretty irresponsible if you aren't using SSL for passwords. You users should be told that your site is insecure, because it is. You should care more about the security of your users. If your hosting does not allow SSL, you have an obligation to change hosts for the safety of your users. If you aren't willing to do…

> You're being pretty irresponsible if you aren't using SSL for passwords. So you're gonna tell me the owner of this site is irresponsible because it has a page with a password field that is not using SSL? http://www.w3schools.com/html/tryit.asp?filename=tryhtml_inp... How can you make any claim without having any idea what (if anything) the password is protecting?

The password form on that page _IS_ insecure and it's good that the user is given information about that. They can then make the decision about themselves about the lack of security and how it effects them and the page they are on.

Re: Chrome 56 will mark HTTP pages with password fields as non-secure

#166

Post by malikNF »

derimagia wrote: post #162
malikNF wrote: post #158

This is such a dumb idea on google's part (and mozilla's) because people are now going to program dumb workarounds for this. Google seriously has to stop trying to police the god damn web.

With free ways to encrypt web coming out, you really have no excuse to not use https for login forms. People should be informed.

This is not the right way to educate people. This is a sort of like shaming someone in to doing something. Many small companies are going have an impact thanks to this.

There are many companies I have personally witnessed that use a direct IP to access web based solutions to their inhouse software, how are these people supposed to get a ssl cert.

We need to educate people, not shame them in to doing the things big google wants from them.

Re: Chrome 56 will mark HTTP pages with password fields as non-secure

#167

Post by twblalock »

wfunction wrote: post #160
twblalock wrote: post #156

Earlier quoted context omitted.

> Now all my users are going to hear that my site is insecure, when nothing at all changed. You're being pretty irresponsible if you aren't using SSL for passwords. You users should be told that your site is insecure, because it is. You should care more about the security of your users. If your hosting does not allow SSL, you have an obligation to change hosts for the safety of your users. If you aren't willing to do…

> You're being pretty irresponsible if you aren't using SSL for passwords. So you're gonna tell me the owner of this site is irresponsible because it has a page with a password field that is not using SSL? http://www.w3schools.com/html/tryit.asp?filename=tryhtml_inp... How can you make any claim without having any idea what (if anything) the password is protecting?

Are you seriously suggesting that a password field in an online code editor on an HTML tutorial site is comparable to the situation we are discussing here?

Re: Chrome 56 will mark HTTP pages with password fields as non-secure

#168

Post by eru »

fastball wrote: post #135
johndoe4589 wrote: post #126

Earlier quoted context omitted.

I know I guess I just have to vent some frustration. Time to move on I guess. Does anyone have good hosting suggestions for a web app that has a 1GB database and a few thousand active users? I can only afford ~10-20 EUR a month on shared hosting atm.

You have a few thousand active monthly users (since it's a web app that requires an account, I'm assuming that corresponds to 50-100k page views per month) and you can't recoup 10-20 EUR a month to cover server costs? I think it's time for a bit of light monetization.

Perhaps johndoe4589 doesn't want to monetize?

(Asking users for donations might work where advertisement perhaps doesn't.)

Re: Chrome 56 will mark HTTP pages with password fields as non-secure

#169

Post by andybak »

ycitm wrote: post #134
johndoe4589 wrote: post #126

Earlier quoted context omitted.

I know I guess I just have to vent some frustration. Time to move on I guess. Does anyone have good hosting suggestions for a web app that has a 1GB database and a few thousand active users? I can only afford ~10-20 EUR a month on shared hosting atm.

If you have control of your nameservers you can use cloudflare's free TLS offering and keep your current webhost.

I'm personally in favour of Cloudflare as the simplest solution - even simpler than letsencrypt. However - there are a few caveats. They tend to hit some countries with a Captcha unless you disable it. Might not be an issue. Their "Flexible SSL is controversial as it only encrypts from client to them - not from them to the server. Personally I think this covers the most obvious threat models and is probably "good enough" for the a lot of use cases.

Re: Chrome 56 will mark HTTP pages with password fields as non-secure

#170

Post by andybak »

simcop2387 wrote: post #149
robbiewxyz wrote: post #140

Earlier quoted context omitted.

I think you could probably just point your DNS at Cloudflare to proxy your site through them; their service includes SSL plus some extras like caching and such for free. I've used them for a handful of projects and it's worked great.

That said it will still be insecure because of the unencrypted path from cloudflare to you server but it will hire the error

For some definitions of "insecure".
Post reply on HN