Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome’s address bar will use https:// by default

blog.chromium.org

Post reply on HN
Print view View original

21–30 of 463 posts

Re: Chrome’s address bar will use https:// by default

#21

Post by iso1631 »

gtys wrote: post #15
dfabulich wrote: post #4

There's no link to more technical detail. What happens when the site I type in the URL bar doesn't support HTTPS? Will it error out? (with a timeout?) Or will it automatically fallback to trying HTTP? (In that case, could a MITM block HTTPS to force the browser to try to downgrade?) EDIT: I see that the article says it will fall back, but Chrome Canary has options in chrome://flags, and it's not clear which option th…

It's in the article: "For sites that don’t yet support HTTPS, Chrome will fall back to HTTP when the HTTPS attempt fails." I hope the slippery slope stops here though and HTTP will not be eradicated in browsers (in which case one would need corporate permission and approval to publish anything). s_client or curl are not a suitable workarounds for the masses ...

Next steps could be

1) Rather than auto-redirect, ask the user if they want to redirect

2) Force the user to type http://server/ to visit the server on http

Neither of those eradicates http.

Re: Chrome’s address bar will use https:// by default

#23

Post by Ajedi32 »

patrickmcnamara wrote: post #22

I'm surprised this took so long. I tried to find an extension recently that could completely block HTTP but I couldn't find anything.

HTTPS Everywhere[1] has a setting for that.

[1]: https://chrome.google.com/webstore/detail/https-everywhere/g...

Re: Chrome’s address bar will use https:// by default

#25

Post by melomal »

pornel wrote: post #13

That makes a lot of sense. HTTPS adoption is now very high[1], and this might push it a little bit further for sites that don't redirect to HTTPS automatically. I've been using Firefox in the experimental HTTPS-only mode, and the web is quite usable without cleartext HTTP. [1] https://transparencyreport.google.com/https/overview It's not a big change from security perspective though. HTTP requests shouldn't be gettin…

> HTTPS adoption is now very high[1]

This is simply because they told SEO's that HTTPs takes precedent and effects ranking - if you want mass adoption of anything then just tell a bunch of SEOs that rankings will be effected (AMP is one that has thankfully not won the fight).

Google passed it off as security but I cannot believe this to be the case when you see the shit that litters the Play Store.

Re: Chrome’s address bar will use https:// by default

#26

Post by colllectorof »

Meanwhile, here is the state of certbot support on shared hosting:

https://certbot.eff.org/hosting_providers

Yellow means you have to jump through hoops as a user. Even though the whole point of managed/shared hosting is that you don't.

So either all those companies whose primary business is to provide hosting are incompetent, or "Let's Encrypt is super easy" narrative is false.

Re: Chrome’s address bar will use https:// by default

#27

Post by [deleted] »

livre wrote: post #14
falcolas wrote: post #2

Strange to see what kinds of things that Chrome leads the way on, and what things it's a distant follower to other browsers on. I'd wonder what value Google would derive from staying with HTTP as a default, but I can't think of anything offhand.

In this case Firefox was first with a slightly different implementation (a warning instead of directly falling back to http). https://blog.mozilla.org/security/2020/11/17/firefox-83-intr... I think the idea originally came from the extension HTTPS Everywhere and its EASE mode back in 2018. https://www.eff.org/deeplinks/2018/12/how-https-everywhere-k...

[deleted]

Re: Chrome’s address bar will use https:// by default

#30

Post by p410n3 »

tialaramex wrote: post #19
p410n3 wrote: post #3

I'm interested If that behavior will be the same when using web.dev Usually when I enter a site to test it there, it always tells me to avoid redirects. I think HSTS would would have also solved this, but our (managed) hosting provider does not offer this as a default, and doing it manually for the amount of sites is not really practical. At least not the sites that are already done.

All of .dev is covered by HSTS pre-loading. So even if you explicitly type http://web.dev/ you are going to actually navigate to https://web.dev/ because that's how HSTS is defined. If you want a site that isn't encrypted in browsers then an entire TLD which is specifically secured is the wrong place to build that site.

I think I explained myself badly. Im entering sites INTO https://web.dev that we make at work. Web.dev is basically Google Lighthouse and tests your website for basic performance, seo, best practices and A11Y.

So for example I enter mycustomer.com and it tells me "avoid http redirects" because I didn't enter the https:// before.

Hsts is included in one of our packages which also includes CSP settings and other security stuff, but barely anyone buys that.

Post reply on HN