Chrome’s address bar will use https:// by default
blog.chromium.org
Chrome’s address bar will use https:// by default
1–10 of 463 posts
Re: Chrome’s address bar will use https:// by default
#2Strange to see what kinds of things that Chrome leads the way on, and what things it's a distant follower to other browsers on.
I'd wonder what value Google would derive from staying with HTTP as a default, but I can't think of anything offhand.
Re: Chrome’s address bar will use https:// by default
#3I'm interested If that behavior will be the same when using web.dev
Usually when I enter a site to test it there, it always tells me to avoid redirects. I think HSTS would would have also solved this, but our (managed) hosting provider does not offer this as a default, and doing it manually for the amount of sites is not really practical. At least not the sites that are already done.
Re: Chrome’s address bar will use https:// by default
#4There's no link to more technical detail. What happens when the site I type in the URL bar doesn't support HTTPS? Will it error out? (with a timeout?) Or will it automatically fallback to trying HTTP? (In that case, could a MITM block HTTPS to force the browser to try to downgrade?)
EDIT: I see that the article says it will fall back, but Chrome Canary has options in chrome://flags, and it's not clear which option they picked.
> Omnibox - Use HTTPS as the default protocol for navigations
> Use HTTPS as the default protocol when the user types a URL without a protocol in the omnibox such as 'example.com'. Presently, such an entry navigates to http://example.com. When this feature is enabled, it will navigate to https://example.com if the HTTPS URL is available. If Chrome can't determine the availability of the HTTPS URL within the timeout, it will fall back to the HTTP URL.
The options are: Enabled, Enabled 3 second timeout, Enabled 10 second timeout, and Disabled.
So how will it work, exactly?
Re: Chrome’s address bar will use https:// by default
#5Doing this helps in some cases against passive attackers, sidesteps the need for a redirect to send visitors to your secure site on first visit to have them pick up your HSTS but it doesn't offer any protection against an active attacker on first visits.
Firefox HTTPS mode gives you a (dismissable) interstitial if any site apparently doesn't do HTTPS, which is an opportunity to catch attacks, but less suitable for non-experts because they will find it hard to judge when to be surprised.
As a site owner, HSTS preload remains what you should do to protect visitors if you know you are going to do HTTPS.
Some day DANE and/or DPRIVE plus HTTPSVC will reliably ensure the visitors to any HTTPS site get HTTPS on contemporary browsers, we're years from that though.
Re: Chrome’s address bar will use https:// by default
#6There's no link to more technical detail. What happens when the site I type in the URL bar doesn't support HTTPS? Will it error out? (with a timeout?) Or will it automatically fallback to trying HTTP? (In that case, could a MITM block HTTPS to force the browser to try to downgrade?) EDIT: I see that the article says it will fall back, but Chrome Canary has options in chrome://flags, and it's not clear which option th…
At the end it states it will then fall back to http.
Re: Chrome’s address bar will use https:// by default
#7There's no link to more technical detail. What happens when the site I type in the URL bar doesn't support HTTPS? Will it error out? (with a timeout?) Or will it automatically fallback to trying HTTP? (In that case, could a MITM block HTTPS to force the browser to try to downgrade?) EDIT: I see that the article says it will fall back, but Chrome Canary has options in chrome://flags, and it's not clear which option th…
From the article: "For sites that don’t yet support HTTPS, Chrome will fall back to HTTP when the HTTPS attempt fails."
Re: Chrome’s address bar will use https:// by default
#8I'm surprised, I already thought this was the default behaviour.
Re: Chrome’s address bar will use https:// by default
#9There's no link to more technical detail. What happens when the site I type in the URL bar doesn't support HTTPS? Will it error out? (with a timeout?) Or will it automatically fallback to trying HTTP? (In that case, could a MITM block HTTPS to force the browser to try to downgrade?) EDIT: I see that the article says it will fall back, but Chrome Canary has options in chrome://flags, and it's not clear which option th…
"For sites that don’t yet support HTTPS, Chrome will fall back to HTTP when the HTTPS attempt fails."
MITM is still an issue. At some point I hope browsers can switch to "you have to type http:// if you want HTTP", and this is a step in that direction.
(Disclosure: I work for Google, speaking only for myself)
Re: Chrome’s address bar will use https:// by default
#10I'm surprised, I already thought this was the default behaviour.
Yes, I thought either FF or Chrome had implemented this before.