We should mark all sites serving Google ads as "spying on you"
Is there an alternative ad network that doesn't spy on users?
Chrome will mark all HTTP sites as ‘not secure’ starting in July
81–90 of 143 posts
Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July
#82Earlier quoted context omitted.
That's exactly the problem. Devices in the local network can not partake in the public CA infrastructure. So they run self-signed certificates, which is probably a small security win over plain HTTP, but then customers are faced with a scary "someone is stealing your data" page before ever seeing the configuration page. That's a no go, so most stay on HTTP, but as we can tell from this announcement, time is running o…
I bought a Uniquiti AMPLIFI home router. It’s great for signal, but can only be administered through their app (all traffic through their cloud, etc). This really sucks and they don’t really care as it’s probably easier to dev and they get all that sweet usage data. It’s not a good trend, but this is a plus for most consumers who don’t care about local network security.
Amplifi should be manageable through UNMS by the end of the year or so. I cant seem to find the chart, but here is an image from the forums: https://usercontent-community.amplifi.com/461f0130-9835-459b...
Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July
#83Earlier quoted context omitted.
This change will only add the grey 'not secure' text to the address bar and not hinder functionality. So it is just less green and not more red as with invalid or self-signed certificates where you have to perform additional steps to continue.
There are already https only features, and their number will probably just keep increasing https://www.digicert.com/blog/https-only-features-in-browser... https://www.chromium.org/Home/chromium-security/deprecating-... https://blog.mozilla.org/security/2018/01/15/secure-contexts...
I can only agree with that. Having security contexts as a formal concept and requiring secure transport for certain features. Stuff like webcam or other hardware access (bluetooth) should really not be allowed from a insecure (MITM'ed?) source.
Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July
#84Earlier quoted context omitted.
DNS? It works for SSH fingerprints. Random example: https://matoski.com/article/sshfp-dns-records/
doesn't that just push the "authority" to DNS. You still need someone to vouch that you are who you say you are.
I'd prefer a wild-west type of world where certs are decentralized and "blind trust" towards big authorities becomes optional and still there as a reinforcement, but not necessary and definitely not required to communicate securely.
I mean- if there are adversaries out there trying to hack our communications- then we need to let these adversaries try so that we can engage them head on so that their methods become published, public, and thoroughly analyzed by the people in charge of strengthening our protocols.
This approach would be like fracturing the bone to make it stronger- we allow nation state hack us in order to figure out ways to stop and prevent such hacks using open and transparent software alone. Trusting any group of people anywhere "just because they're trust worthy" feels like a variable defining as equal to . It just doesn't make sense for a variable to trust itself "just because" because then I wonder if something fishy is going on under the hood.
Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July
#85Earlier quoted context omitted.
doesn't that just push the "authority" to DNS. You still need someone to vouch that you are who you say you are.
I'd prefer a wild-west type of world where certs are decentralized and "blind trust" towards big authorities becomes optional and still there as a reinforcement, but not necessary and definitely not required to communicate securely. I mean- if there are adversaries out there trying to hack our communications- then we need to let these adversaries try so that we can engage them head on so that their methods become pub…
That's exactly what you don't want if you can't trust your ISP.
Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July
#86Bye bye chrome. You were useful until you started pushing your agenda on everyone
Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July
#87Earlier quoted context omitted.
But how am I supposed to know if I can trust it if it is the first time I am using it?
Some kind of cert observatory tool that checks if the cert you're getting matches the cert everyone else is getting.
If only there was some kind of distributed ledger thing we could use to make sure everyone had the same information as everyone else using cryptography
Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July
#88Because my statically generated blog really needs https. This is really going to create an additional layer of inconvenience for people who just want to drop some html documents in an ftp folder and be done with it.
If the only advantage you can think of for sending traffic unencrypted is that it saves you a small amount of time, you're unlikely to find anyone who cares.
"I'm lazy, so I don't want to set up encryption on my website, but please don't tell my site visitors. They don't need to know"
Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July
#89Earlier quoted context omitted.
But how am I supposed to know if I can trust it if it is the first time I am using it?
I trust more my first time connection to a website than so random authority a random country signing it, it’s that simple. But the money grab is so big that they keep existing ! EDIT: And you’re saying the SSH model is broken then. Also you can verify the certificate signature via another channel, like a git repo of all the signatures of most important websites (I know, it look like a CA)
Maybe it my problem, because I don't understand all my options.
But when I spin up a new cloud server built on some image from a cloud provider, I am not sure how I can verify this certificate. How can I verify I am not being Mitm'ed on this new server?
Or maybe the cloud provider is dropping the ball in not giving me the fingerprint when I request its creation?
But yes, it does seem broken to me.
Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July
#90Earlier quoted context omitted.
DNS? It works for SSH fingerprints. Random example: https://matoski.com/article/sshfp-dns-records/
doesn't that just push the "authority" to DNS. You still need someone to vouch that you are who you say you are.
Well, yeah. You need to trust someone. And if you aren't willing to centralize, then you're left with key signing parties.