Chrome will mark all HTTP sites as ‘not secure’ starting in July • Hacker News Board

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#31

Post by icebraining » Wed, Jul 11, 2018, 5:31 PM UTC

hartator wrote: post #15

bowlich wrote: post #8

Because my statically generated blog really needs https. This is really going to create an additional layer of inconvenience for people who just want to drop some html documents in an ftp folder and be done with it.

Yes, plus it gives the feeling that https://chase-very-secure-sign-in-1024-bits-certificate.scam... is perfectly secure when it’s not. Good education >> Browser gimmicks.

On the contrary, the move is also to remove the padlock and "Secure" signs from such sites.

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#32

Post by stefan_ » Wed, Jul 11, 2018, 5:32 PM UTC

craftyguy wrote: post #10

stefan_ wrote: post #5

So, what is the Chromes team solution for local network devices like routers? Proxy it over the manufacturers server for a complete loss of any privacy and security, but hey, there is a green check mark then?

do many routers not support https for their config pages? if so, that's terrible on their part, get a new router. If they do, then accept the cert in your browser and move on.

That's exactly the problem. Devices in the local network can not partake in the public CA infrastructure. So they run self-signed certificates, which is probably a small security win over plain HTTP, but then customers are faced with a scary "someone is stealing your data" page before ever seeing the configuration page. That's a no go, so most stay on HTTP, but as we can tell from this announcement, time is running out for that. Leaving them with zero good options.

If this trend continues it means you will no longer be able to configure these devices with a webbrowser but forced to use the manufacturers "cloud solution" or install an app where both ends of the TLS connection can be controlled and you're not bound to public CAs.

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#33

Post by elorant » Wed, Jul 11, 2018, 5:34 PM UTC

skolemtotem wrote: post #14

robin_reala wrote: post #9

Earlier quoted context omitted.

But your static blog isn’t secure served over HTTP. And that’s fine if you choose it.

Oh no, someone's going to MITM my shitty blog posts. "Secure" is a word that only makes sense with context, and without that context it only serves to cause irrational panic. I wonder why Google's really doing this.

You'd be amazed at the amount of web sites which are not secured. E-commerce sites, corporate sites, classified sites, you name it. How unlikely would be to visit a news site through some "free" vpn service only to have most of the ads replaced with shady ones. I mean let's get realistic here, https while inconvenient will make the web a better place. And even if your site isn't secure most users won't even notice because they rarely ever watch the address bar. If they did there wouldn't be a bazillion of phising attacks out there.

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#34

Post by tialaramex » Wed, Jul 11, 2018, 5:35 PM UTC

jcoffland wrote: post #28

I wish Chrome would make an exception for pages on localhost and devices on the local network. There are currently no good solutions for acquiring certificates in these cases.

Localhost already is an exception. For best browser compatibility use either 127.0.0.1 or ::1 as appropriate rather than the name localhost.

The browser has no realistic way to conclude that your "local" network is secure. It probably isn't. So there's no sane policy that says that's OK

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#35

Post by projct » Wed, Jul 11, 2018, 5:36 PM UTC

zokier wrote: post #19

stefan_ wrote: post #5

So, what is the Chromes team solution for local network devices like routers? Proxy it over the manufacturers server for a complete loss of any privacy and security, but hey, there is a green check mark then?

I don't know why there is still no standardization for advertising/providing CA services for local networks. How difficult would it be to just put local ACME endpoint to DHCP options?

adding a local CA means you can middleman anything you want to, seems like something that should be difficult to do, to me.

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#36

Post by 0x0 » Wed, Jul 11, 2018, 5:37 PM UTC

bowlich wrote: post #8

Because my statically generated blog really needs https. This is really going to create an additional layer of inconvenience for people who just want to drop some html documents in an ftp folder and be done with it.

How is having a "not secure" label showing up on your not secure http html folder an inconvenience? I think it makes more sense to move to secure by default, with a large "not secure" label for the nondefault (non-https) sites. Better to be proactive with the labeling than relying on endusers having to remember to look for that little padlock now that letsencrypt hands out certificates for free in a super easy, automated fashion.

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#37

Post by 0x0 » Wed, Jul 11, 2018, 5:39 PM UTC

zokier wrote: post #19

stefan_ wrote: post #5

So, what is the Chromes team solution for local network devices like routers? Proxy it over the manufacturers server for a complete loss of any privacy and security, but hey, there is a green check mark then?

I don't know why there is still no standardization for advertising/providing CA services for local networks. How difficult would it be to just put local ACME endpoint to DHCP options?

ACME has nothing to do with provisioning root certificate trust stores and I hope DHCP never will either. If you need additional local root CAs then deploy them via enterprise workstation management solutions.

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#38

Post by patmcguire » Wed, Jul 11, 2018, 5:41 PM UTC

UncleMeat wrote: post #18

skolemtotem wrote: post #14

Earlier quoted context omitted.

Oh no, someone's going to MITM my shitty blog posts. "Secure" is a word that only makes sense with context, and without that context it only serves to cause irrational panic. I wonder why Google's really doing this.

Yes. They literally will. ISPs have injected ads into pages delivered to their customers. Data integrity also comes from HTTPS too.

Boxing out ISPs is probably a large part of why they're doing it. Google believes traffic should be able to go directly from your computer to the server in question and then load up Adsense without any interference from your ISP injecting ads. They can do things for more than one reason, it's a good thing, but it also nullifies one of the few channels they don't have access to.

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#39

Post by zokier » Wed, Jul 11, 2018, 5:42 PM UTC

aequitas wrote: post #23

stefan_ wrote: post #5

So, what is the Chromes team solution for local network devices like routers? Proxy it over the manufacturers server for a complete loss of any privacy and security, but hey, there is a green check mark then?

This change will only add the grey 'not secure' text to the address bar and not hinder functionality. So it is just less green and not more red as with invalid or self-signed certificates where you have to perform additional steps to continue.

There are already https only features, and their number will probably just keep increasing

https://www.digicert.com/blog/https-only-features-in-browser...

https://www.chromium.org/Home/chromium-security/deprecating-...

https://blog.mozilla.org/security/2018/01/15/secure-contexts...

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#40

Post by 0x0 » Wed, Jul 11, 2018, 5:43 PM UTC

stefan_ wrote: post #32

craftyguy wrote: post #10

Earlier quoted context omitted.

do many routers not support https for their config pages? if so, that's terrible on their part, get a new router. If they do, then accept the cert in your browser and move on.

That's exactly the problem. Devices in the local network can not partake in the public CA infrastructure. So they run self-signed certificates, which is probably a small security win over plain HTTP, but then customers are faced with a scary "someone is stealing your data" page before ever seeing the configuration page. That's a no go, so most stay on HTTP, but as we can tell from this announcement, time is running o…

I think you are jumping to conclusions for no good reason here, I think it's absolutely unlikely to happen that browsers remove http support. Worst case they'll add a clickthrough screen similar to the invalid ssl interstitials of today. Surely you can deal with an extra click through when logging in to your wifi router if you can't be bothered to install an ssl cert for it?