Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome will mark all HTTP sites as ‘not secure’ starting in July

theverge.com

Post reply on HN
Print view View original

11–20 of 143 posts

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#11

Post by jdlyga »

craftyguy wrote: post #10
stefan_ wrote: post #5

So, what is the Chromes team solution for local network devices like routers? Proxy it over the manufacturers server for a complete loss of any privacy and security, but hey, there is a green check mark then?

do many routers not support https for their config pages? if so, that's terrible on their part, get a new router. If they do, then accept the cert in your browser and move on.

The Ubiquity routers use a self signed certificate, which Chrome already marks as insecure. There's ways to change it to use Let's Encrypt though.

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#12

Post by [deleted] »

BrowncoatShadow wrote: post #4
ksri wrote: post #2

Is this also true for localhost, or does localhost get special treatment? What is a good way to get https certificates for localhost other than self signed certificates?

https://github.com/FiloSottile/mkcert Still self-signed, but generates a CA that gets added to your browser. It is all pretty seamless.

[deleted]

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#13

Post by freeone3000 »

jdlyga wrote: post #11
craftyguy wrote: post #10

Earlier quoted context omitted.

do many routers not support https for their config pages? if so, that's terrible on their part, get a new router. If they do, then accept the cert in your browser and move on.

The Ubiquity routers use a self signed certificate, which Chrome already marks as insecure. There's ways to change it to use Let's Encrypt though.

Adding this cert to your trusted certs file marks it as secure, even if self-signed. This is better than usual.

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#14

Post by skolemtotem »

robin_reala wrote: post #9
bowlich wrote: post #8

Because my statically generated blog really needs https. This is really going to create an additional layer of inconvenience for people who just want to drop some html documents in an ftp folder and be done with it.

But your static blog isn’t secure served over HTTP. And that’s fine if you choose it.

Oh no, someone's going to MITM my shitty blog posts. "Secure" is a word that only makes sense with context, and without that context it only serves to cause irrational panic. I wonder why Google's really doing this.

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#15

Post by hartator »

bowlich wrote: post #8

Because my statically generated blog really needs https. This is really going to create an additional layer of inconvenience for people who just want to drop some html documents in an ftp folder and be done with it.

Yes, plus it gives the feeling that https://chase-very-secure-sign-in-1024-bits-certificate.scam... is perfectly secure when it’s not.

Good education >> Browser gimmicks.

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#16

Post by hughes »

bowlich wrote: post #8

Because my statically generated blog really needs https. This is really going to create an additional layer of inconvenience for people who just want to drop some html documents in an ftp folder and be done with it.

Nobody's saying it does - including Chrome. The browser will simply (and correctly) show "Not Secure" in the address bar when next to the url viewing your blog. If a user doesn't have an expectation of security, they won't be bothered or perhaps even notice.

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#17

Post by ktsmith »

craftyguy wrote: post #10
stefan_ wrote: post #5

So, what is the Chromes team solution for local network devices like routers? Proxy it over the manufacturers server for a complete loss of any privacy and security, but hey, there is a green check mark then?

do many routers not support https for their config pages? if so, that's terrible on their part, get a new router. If they do, then accept the cert in your browser and move on.

Most consumer routers use self signed certificates which will be marked as insecure by the browser.

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#18

Post by UncleMeat »

skolemtotem wrote: post #14
robin_reala wrote: post #9

Earlier quoted context omitted.

But your static blog isn’t secure served over HTTP. And that’s fine if you choose it.

Oh no, someone's going to MITM my shitty blog posts. "Secure" is a word that only makes sense with context, and without that context it only serves to cause irrational panic. I wonder why Google's really doing this.

Yes. They literally will. ISPs have injected ads into pages delivered to their customers. Data integrity also comes from HTTPS too.

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#19

Post by zokier »

stefan_ wrote: post #5

So, what is the Chromes team solution for local network devices like routers? Proxy it over the manufacturers server for a complete loss of any privacy and security, but hey, there is a green check mark then?

I don't know why there is still no standardization for advertising/providing CA services for local networks. How difficult would it be to just put local ACME endpoint to DHCP options?

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#20

Post by LeoPanthera »

wildpeaks wrote: post #7

If you wonder how to get HTTPS for your local virtual hosts: 1. create a local CA 2. create a certificate using that local CA 3. Then you can add the CA in your trusted authorities (Firefox does need an extra step: either enable the "security.enterprise_roots.enabled" flag, either import the CA certificate manually in it). Details at: https://gist.github.com/cecilemuller/9492b848eb8fe46d462abeb...

I found this script to manage your local CA:

https://github.com/FiloSottile/mkcert

Post reply on HN