We should mark all sites serving Google ads as "spying on you"
The last GDPR preferences link I clicked on showed nearly 100 companies potentially spying on me. Google is barely the tip of the iceberg.
Chrome will mark all HTTP sites as ‘not secure’ starting in July
91–100 of 143 posts
Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July
#92Bye bye chrome. You were useful until you started pushing your agenda on everyone
You're kidding right? Its 2018, there is no reason to not use https these days. With lets encrypt its not like its costing you anything.
Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July
#93Earlier quoted context omitted.
Nobody's saying it does - including Chrome. The browser will simply (and correctly) show "Not Secure" in the address bar when next to the url viewing your blog. If a user doesn't have an expectation of security, they won't be bothered or perhaps even notice.
Which is great for users that understand what these security concerns are all about, like typical HN folk. But these people are probably aware of cyber security already, so not much gain here. And people that _don't_ understand cyber security will have no context for what "not secure" means, and may needlessly avoid a variety of HTTP static-HTML sites, where these security issues aren't that great a concern.
Um, good? If people avoid your site because its not secure, maybe you should fix it?
Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July
#94Earlier quoted context omitted.
It depends how often you want to update things I guess. A wildcard costs less than $50 a year these days, so if that might be better for some people than renewing their LE every few months.
I almost sympathize but 1. Maximum cert lifetimes are falling, once upon a time you'd just pony up the cash and get five years. A year ago it was 36 months, for a few months now it's been 825 days, and there is downward pressure. So you are still going to need to renew this cert, and that means... 2. You can and should automate. Imagine buying a device in 2018 that expects you to manually input an IP address because…
Between Certs and Java, it's the older IPMI devices that really kill me. I have some that don't even allow for custom certs and none support that type of automation that I'm aware of. In theory these problems go away over time but most of my home servers are in the cost vs. performance-per-watt sweet spot and won't be replaced for many years.
Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July
#95All traffic encrypted means no one can see your outbound transmission data, including you! No way to verify what you're sending on the wire if the application is proprietary (and statically compiled) without dumping memory, which would be quite odious.
No, developer tools.
Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July
#96So, what is the Chromes team solution for local network devices like routers? Proxy it over the manufacturers server for a complete loss of any privacy and security, but hey, there is a green check mark then?
I don't know why there is still no standardization for advertising/providing CA services for local networks. How difficult would it be to just put local ACME endpoint to DHCP options?
This sounds great acually. Browsers should only trust them when connecting to local IPs (based on subnet or something), is displayed as a gray padlock that says "Local", the ACME endpoint should be restricted to only giving out certs on specific domains (.local or something), and to reissue any cert with the same name as a previous cert the device has to prove that it's the same (unique embedded public key or something). Maybe an exception that devices can always get a local cert for its IP, and the owner of the ACME device can assign "pretty" names to "unique" names on a case-by-case basis.
The thing issuing DHCP leases has full control over your ability to connect to the internet anyways, so around here seems like the right place to put it.
My only qualm is that I trust router manufacturers to implement this correctly about as far as I can throw a sheet of paper.
Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July
#97If you wonder how to get HTTPS for your local virtual hosts: 1. create a local CA 2. create a certificate using that local CA 3. Then you can add the CA in your trusted authorities (Firefox does need an extra step: either enable the "security.enterprise_roots.enabled" flag, either import the CA certificate manually in it). Details at: https://gist.github.com/cecilemuller/9492b848eb8fe46d462abeb...
Let’s push for self-signed certicates everywhere ! Let’s do Trust On First Use like SSH and now we’re done with all this certificates authorities bloated bureaucraties
[deleted]
Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July
#98I thought this had been the case for a while now? I swear I've seen this headline 10 times in the last two years.
Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July
#99Earlier quoted context omitted.
Some kind of cert observatory tool that checks if the cert you're getting matches the cert everyone else is getting.
If only there was some kind of distributed ledger thing we could use to make sure everyone had the same information as everyone else using cryptography
My understanding is that Certificate Transparency (https://www.certificate-transparency.org/) is pretty much that.
"Certificate Transparency helps eliminate these flaws by providing an open framework for monitoring and auditing SSL certificates in nearly real time. Specifically, Certificate Transparency makes it possible to detect SSL certificates that have been mistakenly issued by a certificate authority or maliciously acquired from an otherwise unimpeachable certificate authority. It also makes it possible to identify certificate authorities that have gone rogue and are maliciously issuing certificates."
"Certificate Transparency logs use a special cryptographic mechanism to facilitate public auditing of certificates and logs. This special cryptographic mechanism, known as a Merkle hash tree, is a simple binary tree consisting of hashed leaves and nodes (see figure 1)."
Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July
#100Earlier quoted context omitted.
I trust more my first time connection to a website than so random authority a random country signing it, it’s that simple. But the money grab is so big that they keep existing ! EDIT: And you’re saying the SSH model is broken then. Also you can verify the certificate signature via another channel, like a git repo of all the signatures of most important websites (I know, it look like a CA)
A few problems: 1. SSH's whining about first connection fingerprint trusting is needlessly petty and nobody actually checks the fingerprints, and in many cases they have no need to do so anyways. 2. Almost all cert errors a user will encounter in the real world are the fault of misconfiguration (wrong domain) or pathological/greed-driven behavior (expiration) rather than something that actually impacts the confidenti…
> A few problems:
> 1. SSH's whining about first connection fingerprint trusting is needlessly petty and nobody actually checks the fingerprints, and in many cases they have no need to do so anyways.
I disagree, but this is really a question of configured defaults and security UX. The first connection you make to a server is not secure, and impacts the security of all subsequent requests to that server.
> 2. Almost all cert errors a user will encounter in the real world are the fault of misconfiguration (wrong domain) or pathological/greed-driven behavior (expiration) rather than something that actually impacts the confidentiality of the connection (which is what we care about).
This is the great success of TLS - attacks are so rare that most users won't encounter them. Misconfiguration is indistinguishable from an attack, so the only reasonable thing to do is to warn the user as if it is an attack. Expiration is not a money grab, especially since the CA with the shortest expiration is also completely free. Expiration is a great thing. It limits the window of vulnerability for compromised certificates, and means that revocation lists like those shipped by chrome do not have to grow endlessly large, since expired certificates can be pruned.
> 3. The fact that all cert errors are treated as the same severity (red screen! exclamation points!!1 YOU ARE IN DANGER!!!1one) conditions people to click by them without thought.
With HSTS, that's not an option - and chrome can be configured by sites and enterprises to disallow bypassing certificate warnings. For example, try bypassing this one: