Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome’s address bar will use https:// by default

blog.chromium.org

Post reply on HN
Print view View original

61–70 of 463 posts

Re: Chrome’s address bar will use https:// by default

#61

Post by OskarS »

bmicraft wrote: post #47
Black101 wrote: post #39

Earlier quoted context omitted.

Default value matters ... it's a bit like opt-in vs opt-out

What's the point in having the protocol spelled out when you have the lock icon anyways? I don't think this would be a useful default.

I agree! The protocol is not particularly interesting information, as long as it indicates secure vs. non-secure connection somehow. As long as it comes along when you copy the URL, it's fine.

The bad version of this trend is when you hide the path after the domain like Safari does. That's awful design, that's a very relevant part of the URL!

Re: Chrome’s address bar will use https:// by default

#62

Post by xeromal »

TimBurr wrote: post #53
banana_giraffe wrote: post #42

Earlier quoted context omitted.

I'm curious if that includes falling back to HTTP when HTTPS has worked in the past. I only ask because I'm curious what this will do with captive portal nonsense.

I've found http://neverssl.com very helpful for captive portals. It does what you'd expect - hosts a HTTP-only page that allows captive portals to work correctly. Since it's only ever HTTP, it sidesteps the certificate errors or HTTP downgrades that normal sites are hit with during captive portal interception. I am curious what happens to captive portals as HTTPS adoption rises. Some OS's (Android, OSX) already detec…

Thanks for this. I never can remember URLs like this but I always remember chicken.com. It's sad day to see it go away.

Re: Chrome’s address bar will use https:// by default

#63

Post by caymanjim »

reaperducer wrote: post #48

When the big push to HTTPS came around, I was all in favor of it. Now... I'm more skeptical. Not everything has to be HTTPS. And I've become aware that many of the sites I visit are HTTP only and will never become HTTPS because of their age, or the lack of technical ability of their owners. HTTPS also has the side effect of obsoleting older hardware for no real reason. I have devices that work perfectly fine, but can…

All Chrome does when you visit an http site right now is put a subtle white warning icon and the words "Not Secure" next to the location bar, in lieu of the lock icon you get with https. There are no blocks, no big red scary icons, no password requests. The content on the page renders identically to a secure page.

Technology moves on, and encryption is important, even if there are some cases where it's not strictly vital. Sure, some recipe page isn't a big deal, but there are plenty of sites out there that accept personal information and still have to be dragged kicking and screaming into the present to secure that information. Sadly the only thing that's going to solve that problem is forcing https-only at some point in the future.

Re: Chrome’s address bar will use https:// by default

#66

Post by rincebrain »

fluidcruft wrote: post #51
pornel wrote: post #13

That makes a lot of sense. HTTPS adoption is now very high[1], and this might push it a little bit further for sites that don't redirect to HTTPS automatically. I've been using Firefox in the experimental HTTPS-only mode, and the web is quite usable without cleartext HTTP. [1] https://transparencyreport.google.com/https/overview It's not a big change from security perspective though. HTTP requests shouldn't be gettin…

The biggest problem I'm having is that our edge firewall doesn't play nicely with it for some reason. I get these random websites that refuse to work in Firefox, but they always work fine in Chrome. And it's not certificate errors, it's just "connection reset by peer". I'm not entirely sure how it's working, but I've seen a few other people with these issues at the mozilla bug tracker and it's always just sort of eit…

Have you tried forcing QUIC on or SPDY off in Firefox to see if either of those options circumvents it?

Re: Chrome’s address bar will use https:// by default

#67

Post by fluidcruft »

hannob wrote: post #60
fluidcruft wrote: post #51

Earlier quoted context omitted.

The biggest problem I'm having is that our edge firewall doesn't play nicely with it for some reason. I get these random websites that refuse to work in Firefox, but they always work fine in Chrome. And it's not certificate errors, it's just "connection reset by peer". I'm not entirely sure how it's working, but I've seen a few other people with these issues at the mozilla bug tracker and it's always just sort of eit…

> The biggest problem I'm having is that our edge firewall doesn't play nicely with it for some reason.[...] I'm not entirely sure how it's working, but I seen a few other people with these issues at the mozilla bug tracker and it's always just sort of either ignored or dismissed. This sounds like you have some expensive enterprise equipment that is doing funny things with your TLS connection, but instead of complain…

I mean that's fair, but it's really frustrating that for whatever reason all the other clients work. I just want to figure out what's going on and how the firewall knows to target firefox. Like I said IT's response is "well who cares just use Chrome".

Re: Chrome’s address bar will use https:// by default

#68

Post by fluidcruft »

rincebrain wrote: post #66
fluidcruft wrote: post #51

Earlier quoted context omitted.

The biggest problem I'm having is that our edge firewall doesn't play nicely with it for some reason. I get these random websites that refuse to work in Firefox, but they always work fine in Chrome. And it's not certificate errors, it's just "connection reset by peer". I'm not entirely sure how it's working, but I've seen a few other people with these issues at the mozilla bug tracker and it's always just sort of eit…

Have you tried forcing QUIC on or SPDY off in Firefox to see if either of those options circumvents it?

No that's new to me. I'll look into it, thanks!

Re: Chrome’s address bar will use https:// by default

#69

Post by BoiledCabbage »

zepearl wrote: post #58
cblconfederate wrote: post #24

Right, can it please stop hiding it though? URLs aren't prose

I agree. Making the protocol visible would confuse less my parents (I've recently seen them writing searches in the address bar BUT as well pasting URLs into Google's website's search field).

> Making the protocol visible would confuse less my parents

Presumably it's not accidental that Google used their chrome browser to make it easy to mix up urls and searches. That means more searches for them. To them the confusion is not a bug, it's a feature.

Re: Chrome’s address bar will use https:// by default

#70

Post by jefftk »

jeswin wrote: post #46
jefftk wrote: post #9

Earlier quoted context omitted.

"For sites that don’t yet support HTTPS, Chrome will fall back to HTTP when the HTTPS attempt fails." MITM is still an issue. At some point I hope browsers can switch to "you have to type http:// if you want HTTP", and this is a step in that direction. (Disclosure: I work for Google, speaking only for myself)

> "you have to type http:// if you want HTTP" That makes sense only to programmers, who make a small fraction of users. Browsers are mainstream; we need to be more thoughtful.

Long term, to normal users, there should be only HTTPS.
Post reply on HN