Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome will mark all HTTP sites as ‘not secure’ starting in July

theverge.com

Post reply on HN
Print view View original

61–70 of 143 posts

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#61

Post by prepend »

stefan_ wrote: post #32
craftyguy wrote: post #10

Earlier quoted context omitted.

do many routers not support https for their config pages? if so, that's terrible on their part, get a new router. If they do, then accept the cert in your browser and move on.

That's exactly the problem. Devices in the local network can not partake in the public CA infrastructure. So they run self-signed certificates, which is probably a small security win over plain HTTP, but then customers are faced with a scary "someone is stealing your data" page before ever seeing the configuration page. That's a no go, so most stay on HTTP, but as we can tell from this announcement, time is running o…

I bought a Uniquiti AMPLIFI home router. It’s great for signal, but can only be administered through their app (all traffic through their cloud, etc). This really sucks and they don’t really care as it’s probably easier to dev and they get all that sweet usage data.

It’s not a good trend, but this is a plus for most consumers who don’t care about local network security.

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#63

Post by compuguy »

LeoPanthera wrote: post #20
wildpeaks wrote: post #7

If you wonder how to get HTTPS for your local virtual hosts: 1. create a local CA 2. create a certificate using that local CA 3. Then you can add the CA in your trusted authorities (Firefox does need an extra step: either enable the "security.enterprise_roots.enabled" flag, either import the CA certificate manually in it). Details at: https://gist.github.com/cecilemuller/9492b848eb8fe46d462abeb...

I found this script to manage your local CA: https://github.com/FiloSottile/mkcert

You can also use the good old EASY-RSA: https://github.com/OpenVPN/easy-rsa

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#64

Post by Karunamon »

rileymat2 wrote: post #60
Buetol wrote: post #57

Earlier quoted context omitted.

Let’s push for self-signed certicates everywhere ! Let’s do Trust On First Use like SSH and now we’re done with all this certificates authorities bloated bureaucraties

But how am I supposed to know if I can trust it if it is the first time I am using it?

Some kind of cert observatory tool that checks if the cert you're getting matches the cert everyone else is getting.

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#66

Post by Buetol »

rileymat2 wrote: post #60
Buetol wrote: post #57

Earlier quoted context omitted.

Let’s push for self-signed certicates everywhere ! Let’s do Trust On First Use like SSH and now we’re done with all this certificates authorities bloated bureaucraties

But how am I supposed to know if I can trust it if it is the first time I am using it?

I trust more my first time connection to a website than so random authority a random country signing it, it’s that simple. But the money grab is so big that they keep existing !

EDIT: And you’re saying the SSH model is broken then. Also you can verify the certificate signature via another channel, like a git repo of all the signatures of most important websites (I know, it look like a CA)

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#67

Post by Karunamon »

Buetol wrote: post #66
rileymat2 wrote: post #60

Earlier quoted context omitted.

But how am I supposed to know if I can trust it if it is the first time I am using it?

I trust more my first time connection to a website than so random authority a random country signing it, it’s that simple. But the money grab is so big that they keep existing ! EDIT: And you’re saying the SSH model is broken then. Also you can verify the certificate signature via another channel, like a git repo of all the signatures of most important websites (I know, it look like a CA)

A few problems:

1. SSH's whining about first connection fingerprint trusting is needlessly petty and nobody actually checks the fingerprints, and in many cases they have no need to do so anyways.

2. Almost all cert errors a user will encounter in the real world are the fault of misconfiguration (wrong domain) or pathological/greed-driven behavior (expiration) rather than something that actually impacts the confidentiality of the connection (which is what we care about).

3. The fact that all cert errors are treated as the same severity (red screen! exclamation points!!1 YOU ARE IN DANGER!!!1one) conditions people to click by them without thought.

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#68

Post by craftyguy »

ktsmith wrote: post #17
craftyguy wrote: post #10

Earlier quoted context omitted.

do many routers not support https for their config pages? if so, that's terrible on their part, get a new router. If they do, then accept the cert in your browser and move on.

Most consumer routers use self signed certificates which will be marked as insecure by the browser.

All modern browsers allow you to import certs into their trust store.

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#70

Post by detaro »

zokier wrote: post #55
projct wrote: post #35

Earlier quoted context omitted.

adding a local CA means you can middleman anything you want to, seems like something that should be difficult to do, to me.

Name constraints are a thing. Local CA should be constrained to signing only local names (roughly matching dhcp domain-name/domain-search options).

Name constraints are not universally supported in browsers sadly.
Post reply on HN