Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome’s address bar will use https:// by default

blog.chromium.org

Post reply on HN
Print view View original

11–20 of 463 posts

Re: Chrome’s address bar will use https:// by default

#11

Post by nozonozon »

dfabulich wrote: post #4

There's no link to more technical detail. What happens when the site I type in the URL bar doesn't support HTTPS? Will it error out? (with a timeout?) Or will it automatically fallback to trying HTTP? (In that case, could a MITM block HTTPS to force the browser to try to downgrade?) EDIT: I see that the article says it will fall back, but Chrome Canary has options in chrome://flags, and it's not clear which option th…

> For sites that don’t yet support HTTPS, Chrome will fall back to HTTP when the HTTPS attempt fails.

It's in the article!

Re: Chrome’s address bar will use https:// by default

#12

Post by tialaramex »

dfabulich wrote: post #4

There's no link to more technical detail. What happens when the site I type in the URL bar doesn't support HTTPS? Will it error out? (with a timeout?) Or will it automatically fallback to trying HTTP? (In that case, could a MITM block HTTPS to force the browser to try to downgrade?) EDIT: I see that the article says it will fall back, but Chrome Canary has options in chrome://flags, and it's not clear which option th…

> What happens when the site I type in the URL bar doesn't support HTTPS?

The article says: "For sites that don’t yet support HTTPS, Chrome will fall back to HTTP when the HTTPS attempt fails."

Yes, a MITM could block this access. This would be an active attack and thus detectable, which is fine if you're the Great Firewall and your existence is government policy but likely to be a problem for some other types of attacker.

In the passive attack case this is strictly better (previously a passive on-path attacker gets to see all the unprefixed URLs typed into a Google that didn't match an HSTS rule it knew, and with this change they do not) in an active attack nothing changes.

Re: Chrome’s address bar will use https:// by default

#13

Post by pornel »

That makes a lot of sense. HTTPS adoption is now very high[1], and this might push it a little bit further for sites that don't redirect to HTTPS automatically. I've been using Firefox in the experimental HTTPS-only mode, and the web is quite usable without cleartext HTTP.

[1] https://transparencyreport.google.com/https/overview

It's not a big change from security perspective though. HTTP requests shouldn't be getting cookies any more, and the redirect isn't revealing anything new (not until we get DoH + ESNI). You still need HSTS preload to defend against active downgrade attacks.

An interesting side effect of the change is that sites won't have have a working HTTP redirect any more. Inevitably, there will be sites that let their HTTP versions rot and break, which will eventually force all other web clients to default to HTTPS for web-compatibility.

Re: Chrome’s address bar will use https:// by default

#14

Post by livre »

falcolas wrote: post #2

Strange to see what kinds of things that Chrome leads the way on, and what things it's a distant follower to other browsers on. I'd wonder what value Google would derive from staying with HTTP as a default, but I can't think of anything offhand.

In this case Firefox was first with a slightly different implementation (a warning instead of directly falling back to http).

https://blog.mozilla.org/security/2020/11/17/firefox-83-intr...

I think the idea originally came from the extension HTTPS Everywhere and its EASE mode back in 2018.

https://www.eff.org/deeplinks/2018/12/how-https-everywhere-k...

Re: Chrome’s address bar will use https:// by default

#15

Post by gtys »

dfabulich wrote: post #4

There's no link to more technical detail. What happens when the site I type in the URL bar doesn't support HTTPS? Will it error out? (with a timeout?) Or will it automatically fallback to trying HTTP? (In that case, could a MITM block HTTPS to force the browser to try to downgrade?) EDIT: I see that the article says it will fall back, but Chrome Canary has options in chrome://flags, and it's not clear which option th…

It's in the article:

"For sites that don’t yet support HTTPS, Chrome will fall back to HTTP when the HTTPS attempt fails."

I hope the slippery slope stops here though and HTTP will not be eradicated in browsers (in which case one would need corporate permission and approval to publish anything).

s_client or curl are not a suitable workarounds for the masses ...

Re: Chrome’s address bar will use https:// by default

#16

Post by tialaramex »

0xdba wrote: post #10
theonlybutlet wrote: post #8

I'm surprised, I already thought this was the default behaviour.

Yes, I thought either FF or Chrome had implemented this before.

Firefox offers HTTPS Mode, which converts all HTTP links to HTTPS first, A HREFs, stuff you type into the URL bar, everything, then if that fails it generates an interstitial page explaining what went wrong with a button to get the unencrypted HTTP site if that's available.

But that's optional (I wouldn't recommend it to anybody who doesn't seem clear on what HTTPS versus HTTP means for example) and far more invasive, though in exchange it delivers more practical security if you understand what's going on. I've enabled it, I have mentioned it to IT people I know socially, I wouldn't suggest my mother or sister try it.

Re: Chrome’s address bar will use https:// by default

#17

Post by notsobig »

theonlybutlet wrote: post #8

I'm surprised, I already thought this was the default behaviour.

i was amazed when i looked into it. brave did it, safari had it hidden in the developer menu, chrome: nope. i figured there was something to be gained for them.

ultimately there arent too many sites you type out much of an endpoint for, but "old.reddit.com/r/ihaveembarrassingsecrets" or whatever is a big one.

Re: Chrome’s address bar will use https:// by default

#19

Post by tialaramex »

p410n3 wrote: post #3

I'm interested If that behavior will be the same when using web.dev Usually when I enter a site to test it there, it always tells me to avoid redirects. I think HSTS would would have also solved this, but our (managed) hosting provider does not offer this as a default, and doing it manually for the amount of sites is not really practical. At least not the sites that are already done.

All of .dev is covered by HSTS pre-loading. So even if you explicitly type http://web.dev/ you are going to actually navigate to https://web.dev/ because that's how HSTS is defined. If you want a site that isn't encrypted in browsers then an entire TLD which is specifically secured is the wrong place to build that site.

Re: Chrome’s address bar will use https:// by default

#20

Post by Ajedi32 »

pornel wrote: post #13

That makes a lot of sense. HTTPS adoption is now very high[1], and this might push it a little bit further for sites that don't redirect to HTTPS automatically. I've been using Firefox in the experimental HTTPS-only mode, and the web is quite usable without cleartext HTTP. [1] https://transparencyreport.google.com/https/overview It's not a big change from security perspective though. HTTP requests shouldn't be gettin…

It seems like this is primarily a performance optimization, at least for now. One less round trip when navigating to a site by typing the domain name when that site redirects to HTTPS (and isn't on the HSTS preload list).
Post reply on HN