Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome will mark all HTTP sites as ‘not secure’ starting in July

theverge.com

Post reply on HN
Print view View original

21–30 of 143 posts

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#21

Post by LeoPanthera »

skolemtotem wrote: post #14
robin_reala wrote: post #9

Earlier quoted context omitted.

But your static blog isn’t secure served over HTTP. And that’s fine if you choose it.

Oh no, someone's going to MITM my shitty blog posts. "Secure" is a word that only makes sense with context, and without that context it only serves to cause irrational panic. I wonder why Google's really doing this.

You may not care if bad actors inject crap into your web page, but I care, as may many of your readers.

This is not a theoretical vulnerability. Comcast routinely adds stuff to unencrypted web pages.

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#22

Post by UncleMeat »

hartator wrote: post #15
bowlich wrote: post #8

Because my statically generated blog really needs https. This is really going to create an additional layer of inconvenience for people who just want to drop some html documents in an ftp folder and be done with it.

Yes, plus it gives the feeling that https://chase-very-secure-sign-in-1024-bits-certificate.scam... is perfectly secure when it’s not. Good education >> Browser gimmicks.

Good education doesn't scale. Browser "gimmicks" help people make better decisions when they don't have good education.

Also I get a huge red alert when I follow that link. Seems like chrome is doing a good job telling people it isn't secure.

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#23

Post by aequitas »

stefan_ wrote: post #5

So, what is the Chromes team solution for local network devices like routers? Proxy it over the manufacturers server for a complete loss of any privacy and security, but hey, there is a green check mark then?

This change will only add the grey 'not secure' text to the address bar and not hinder functionality. So it is just less green and not more red as with invalid or self-signed certificates where you have to perform additional steps to continue.

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#24

Post by giobox »

skolemtotem wrote: post #14
robin_reala wrote: post #9

Earlier quoted context omitted.

But your static blog isn’t secure served over HTTP. And that’s fine if you choose it.

Oh no, someone's going to MITM my shitty blog posts. "Secure" is a word that only makes sense with context, and without that context it only serves to cause irrational panic. I wonder why Google's really doing this.

> I wonder why Google's really doing this.

You don't have to wonder all that hard given how publicly Google has discussed their stance on this. They have been using their leverage to try to force SSL usage for some time, including adversely affecting search rankings for sites that don't use it. They have clearly articulated many times they think SSL everywhere is important for the web, and they have the leverage in search/browser marketshare to try to make this a reality.

> https://security.googleblog.com/2014/08/https-as-ranking-sig...

The Google IO talk for Google's desire for "HTTPS everywhere"

> https://www.youtube.com/watch?v=cBhZ6S0PFCY&utm_source=wmx_b...

For what its worth, most metrics show a significant jump in SSL usage in 2016/17 following the announcement that it could adversely affect search rankings, although who knows if the two are related.

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#25

Post by amaccuish »

bowlich wrote: post #8

Because my statically generated blog really needs https. This is really going to create an additional layer of inconvenience for people who just want to drop some html documents in an ftp folder and be done with it.

And what happens if my grandmother mitm your site to redirect to a fake login page. Internet security is everyone hosting on the internet's responsibility. You're doing a disservice to your users.

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#27

Post by [deleted] »

hughes wrote: post #16
bowlich wrote: post #8

Because my statically generated blog really needs https. This is really going to create an additional layer of inconvenience for people who just want to drop some html documents in an ftp folder and be done with it.

Nobody's saying it does - including Chrome. The browser will simply (and correctly) show "Not Secure" in the address bar when next to the url viewing your blog. If a user doesn't have an expectation of security, they won't be bothered or perhaps even notice.

[deleted]

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#29

Post by jessaustin »

aequitas wrote: post #23
stefan_ wrote: post #5

So, what is the Chromes team solution for local network devices like routers? Proxy it over the manufacturers server for a complete loss of any privacy and security, but hey, there is a green check mark then?

This change will only add the grey 'not secure' text to the address bar and not hinder functionality. So it is just less green and not more red as with invalid or self-signed certificates where you have to perform additional steps to continue.

That's in this version. How many versions until we get the ridiculous harassment already required for self-signed certs?
Post reply on HN