Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome’s address bar will use https:// by default

blog.chromium.org

Post reply on HN
Print view View original

51–60 of 463 posts

Re: Chrome’s address bar will use https:// by default

#51

Post by fluidcruft »

pornel wrote: post #13

That makes a lot of sense. HTTPS adoption is now very high[1], and this might push it a little bit further for sites that don't redirect to HTTPS automatically. I've been using Firefox in the experimental HTTPS-only mode, and the web is quite usable without cleartext HTTP. [1] https://transparencyreport.google.com/https/overview It's not a big change from security perspective though. HTTP requests shouldn't be gettin…

The biggest problem I'm having is that our edge firewall doesn't play nicely with it for some reason. I get these random websites that refuse to work in Firefox, but they always work fine in Chrome. And it's not certificate errors, it's just "connection reset by peer".

I'm not entirely sure how it's working, but I've seen a few other people with these issues at the mozilla bug tracker and it's always just sort of either ignored or dismissed or people say it's caused by antivirus (which I don't have). I can't figure out how to debug it because literally everything else I try works. curl/wget/etc. I asked IT about it and they just said that I should use Chrome.

Firefox just gives a "connection reset by peer" error and literally nothing more. Changing the new firefox security settings has no effect. The exact same url put in chromium or chrome or curl or wget loads fine. I cannot find anything that doesn't work except firefox. So either the firewall is specifically targeting firefox for some (and only some) https sites or there's something going on in firefox. It's literally the only reason I'm considering not using firefox at this point. I've just got no idea what to do or how to debug this. Thankfully, most major sites work fine. But it's annoying when some website blocks off like this.

Re: Chrome’s address bar will use https:// by default

#52

Post by squaresmile »

bmicraft wrote: post #47
Black101 wrote: post #39

Earlier quoted context omitted.

Default value matters ... it's a bit like opt-in vs opt-out

What's the point in having the protocol spelled out when you have the lock icon anyways? I don't think this would be a useful default.

One thing that was quite annoying to me is the URL changing under my cursor on double-click if the protocol is hidden. However, I can see that editing the URL is a niche use case. Fair enough.

Re: Chrome’s address bar will use https:// by default

#53

Post by TimBurr »

banana_giraffe wrote: post #42
jefftk wrote: post #9

Earlier quoted context omitted.

"For sites that don’t yet support HTTPS, Chrome will fall back to HTTP when the HTTPS attempt fails." MITM is still an issue. At some point I hope browsers can switch to "you have to type http:// if you want HTTP", and this is a step in that direction. (Disclosure: I work for Google, speaking only for myself)

I'm curious if that includes falling back to HTTP when HTTPS has worked in the past. I only ask because I'm curious what this will do with captive portal nonsense.

I've found http://neverssl.com very helpful for captive portals. It does what you'd expect - hosts a HTTP-only page that allows captive portals to work correctly.

Since it's only ever HTTP, it sidesteps the certificate errors or HTTP downgrades that normal sites are hit with during captive portal interception.

I am curious what happens to captive portals as HTTPS adoption rises. Some OS's (Android, OSX) already detect captive portals and launch a lightweight webview.

Re: Chrome’s address bar will use https:// by default

#54

Post by Sanzig »

sharedhostvet wrote: post #41
silvestrov wrote: post #36

Earlier quoted context omitted.

This filter bubble are of the very sensible conviction that those hosting providers then need to get their act together or go out of business. HTTPS is old tech. "Let's Encrypt" is free.

I can tell you from personal experience that they are in the process of going out of business. Traditional shared hosts got their lunch eaten starting almost a decade ago with a combination of site builders like Weebly on the user friendly side and AWS on the technical side. In 2013 most of my social group was friends I made in the shared hosting industry. Now I don't know a single person still working for any MSP as…

And for technical users who find AWS/GCP/Azure and friends too expensive for whatever reason, there's enough small bargain basement VPS providers around that still beat the prices of the shared hosting providers while providing way more flexibility. I run my personal blog using a mom-and-pop KVM VPS provider that costs $2 per month, and I get full control over whatever stack I want to run.

Shared hosting is awful, I don't know why anyone would ever want to go back. Here's an Apache server we set up, it's got every module under the sun enabled along with the associated security holes. You get one PHP version that we upgrade at our leisure, and a shared MySQL server that you pay per database for. Eugh.

Re: Chrome’s address bar will use https:// by default

#55

Post by harikb »

#1 thing I want for my security is a browser that makes the address bar text box very large for typing (and only when I am typing that address). I am tired of tiny address bars.

Also make it easy for me to cut and remove the path. Some bad sites don’t recover properly from a bad session or query argument

Re: Chrome’s address bar will use https:// by default

#56

Post by prepend »

reaperducer wrote: post #48

When the big push to HTTPS came around, I was all in favor of it. Now... I'm more skeptical. Not everything has to be HTTPS. And I've become aware that many of the sites I visit are HTTP only and will never become HTTPS because of their age, or the lack of technical ability of their owners. HTTPS also has the side effect of obsoleting older hardware for no real reason. I have devices that work perfectly fine, but can…

I like using http where appropriate and not wasting resources.

I publish a blog and there’s no need for https. Adding https just adds a little more effort and provides no benefit to the user.

I guess if you count the ISP not knowing, but Google knowing, that you’re visiting my blog, then that’s a reason. But that’s a user issue, not a server issue.

Practically, my host does all the cert stuff for me and it’s not hard. I just don’t like the gradual complexification of the web when there’s not a good reason.

Moving more stuff to ssl that doesn’t need to be just burns up extra compute.

I hope someone calculates the carbon footprint of SSLing all the stuff that doesn’t need SSL. While each action it tiny, there’s trillions of cpu cycles wasted on encrypting stuff that doesn’t benefit from encrypting.

Re: Chrome’s address bar will use https:// by default

#58

Post by zepearl »

cblconfederate wrote: post #24

Right, can it please stop hiding it though? URLs aren't prose

I agree. Making the protocol visible would confuse less my parents (I've recently seen them writing searches in the address bar BUT as well pasting URLs into Google's website's search field).

Re: Chrome’s address bar will use https:// by default

#59

Post by morpheuskafka »

colllectorof wrote: post #32
pornel wrote: post #13

That makes a lot of sense. HTTPS adoption is now very high[1], and this might push it a little bit further for sites that don't redirect to HTTPS automatically. I've been using Firefox in the experimental HTTPS-only mode, and the web is quite usable without cleartext HTTP. [1] https://transparencyreport.google.com/https/overview It's not a big change from security perspective though. HTTP requests shouldn't be gettin…

>HTTPS adoption is now very high[1] I posted this in a separate comment and I will post it again. https://certbot.eff.org/hosting_providers HTTPS adoption is hard enough that the wast majority of shared hosting providers haven't automated cert provisioning and are delegating this process to their users. The push towards forced HTTPS has significant costs, which most people in this filter bubble don't want to honestly…

If you aren't technical enough to manage provisioning yourself, or don't want to, you are most likely throwing the site behind Cloudflare which automagically terminates TLS for free, or paying for some other CDN that does the same. Or if you really aren't technical at all, you would be using Wordpress.com or a similar platform that takes care of it for you.

Actually, I have seen several domain registrars that want to advertise "free SSL" implementing some sort of basic Let's Encrypt provisioning tool that automatically updates the TXT records to get them.

Re: Chrome’s address bar will use https:// by default

#60

Post by hannob »

fluidcruft wrote: post #51
pornel wrote: post #13

That makes a lot of sense. HTTPS adoption is now very high[1], and this might push it a little bit further for sites that don't redirect to HTTPS automatically. I've been using Firefox in the experimental HTTPS-only mode, and the web is quite usable without cleartext HTTP. [1] https://transparencyreport.google.com/https/overview It's not a big change from security perspective though. HTTP requests shouldn't be gettin…

The biggest problem I'm having is that our edge firewall doesn't play nicely with it for some reason. I get these random websites that refuse to work in Firefox, but they always work fine in Chrome. And it's not certificate errors, it's just "connection reset by peer". I'm not entirely sure how it's working, but I've seen a few other people with these issues at the mozilla bug tracker and it's always just sort of eit…

> The biggest problem I'm having is that our edge firewall doesn't play nicely with it for some reason.[...] I'm not entirely sure how it's working, but I seen a few other people with these issues at the mozilla bug tracker and it's always just sort of either ignored or dismissed.

This sounds like you have some expensive enterprise equipment that is doing funny things with your TLS connection, but instead of complaining to your enterprise vendor that you likely pay a lot of money to, you complain to an open source project that probably has nothing to do with it.

Post reply on HN