Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome’s address bar will use https:// by default

blog.chromium.org

Post reply on HN
Print view View original

111–120 of 463 posts

Re: Chrome’s address bar will use https:// by default

#111

Post by simias »

I wish there was a solution for those of us who develop web interfaces for embedded products designed to live on LAN, often without any internet access and no well defined domain name.

I'm all for HTTPS everywhere but right now for my products it's either: https with self-signed certificate, which basically makes any modern browser tell its user that they're in a very imminent danger of violent death should they decide to proceed, or just go with good old HTTP but then you hit all sorts of limitations, and obviously zero security.

I wish there was a way to opt into a "TOFU" https mode for these use cases (which is how browser dealt with invalid HTTPS certificates for a long time), although I realize that doing that without compromising the security of the internet at large might be tricky.

If somebody has a solution, I'm all ears. As far as I can tell the "solution" employed by many IoT vendors is simply to mandate an internet connection and have you access your own LAN devices through the cloud, which is obviously a privacy nightmare. But it's HTTPS so your browser will display a very reassuring padlock telling you all is fine!

Re: Chrome’s address bar will use https:// by default

#112

Post by shadowgovt »

greenwich26 wrote: post #102
paganel wrote: post #86

Earlier quoted context omitted.

That is a stupid idea, forcing https on people’s throats is a stupid idea generally speaking but it wouldn’t have been that bad if it hadn’t been forced on many people by what is basically a monopoly by this point.

HTTPS is such a scam. It's an obvious ploy to conquer the last corners of the web not yet under corporate control. But apparently calling it "Let's Encrypt" instead of "Let's make your website technically dependent on a Google/Mozilla/Amazon/Facebook-controlled service" is enough to fool people. It's totally obvious to me that, once HTTPS is mandatory, the next step will be that Let's Encrypt will stop supporting web…

While there are a finite number of trust providers in the HTTPS signed certificate model, "Let's Encrypt" isn't the only one.

But, yes, HTTPS is a trust-rooted security model. It's hypothetically possible to have every cert provider decide you're not trusted. That's kind of in the category of "It's hypothetically possible to have every DNS provider decide you're not trusted" though.

If this is a concern, the solution is probably to come up with an HTTPS modification that allows for decentralized trust, not to set up the average use case of the web to "The user is trusting every machine between their client and the server to be reading their traffic and not acting maliciously on it." Tradeoffs, right?

Re: Chrome’s address bar will use https:// by default

#113

Post by Spivak »

paganel wrote: post #86
jefftk wrote: post #9

Earlier quoted context omitted.

"For sites that don’t yet support HTTPS, Chrome will fall back to HTTP when the HTTPS attempt fails." MITM is still an issue. At some point I hope browsers can switch to "you have to type http:// if you want HTTP", and this is a step in that direction. (Disclosure: I work for Google, speaking only for myself)

That is a stupid idea, forcing https on people’s throats is a stupid idea generally speaking but it wouldn’t have been that bad if it hadn’t been forced on many people by what is basically a monopoly by this point.

I really don’t get this opinion. The internet isn’t secure — the public internet is by definition an untrusted network assumed to be malicious and openly hostile. There is no safe way to use unencrypted connections on the public internet. None. Doesn’t matter if you are a good admin on your local network, doesn’t matter if you have a good ISP, you have zero guarantee the network path your packets will take and who has the opportunity to observe and modify them.

Look I get it. It’s no fun when the whole class is punished because because bad actors exist. And it’s no fun when someone pressures you into doing something for the benefit of others but not yourself. But the internet is really really different from 20 years ago.

Re: Chrome’s address bar will use https:// by default

#114

Post by Spivak »

tialaramex wrote: post #5

Doing this helps in some cases against passive attackers, sidesteps the need for a redirect to send visitors to your secure site on first visit to have them pick up your HSTS but it doesn't offer any protection against an active attacker on first visits. Firefox HTTPS mode gives you a (dismissable) interstitial if any site apparently doesn't do HTTPS, which is an opportunity to catch attacks, but less suitable for no…

I don’t think it’s enough to actually drop your redirect on the server side yet since there’s lots of non-browser clients.

Re: Chrome’s address bar will use https:// by default

#115

Post by shadowgovt »

maxk42 wrote: post #64

I've said it many times, but nobody seems concerned: Certificate authorities are being used as tools of censorship by oppressive regimes. Until a central-authority-free alternative exists, the move to HTTPS is bad for a free world.

Is it better for a free world to have the traffic be unencrypted?

Feels like one head of the hydra is control of the cert-trust network, but another head is traffic-sniffing and monitoring one's online activity, yeah?

Re: Chrome’s address bar will use https:// by default

#116

Post by johnghanks »

Black101 wrote: post #39
SquareWheel wrote: post #38

Earlier quoted context omitted.

Hiding it? Just enable "Always Show Full URLs" in the omnibar.

Default value matters ... it's a bit like opt-in vs opt-out

The vast majority of people not only don't care about the https / www part of the URL, they don't understand it. You're right, the default value does matter... just not in the way that you think.

Re: Chrome’s address bar will use https:// by default

#117

Post by liveoneggs »

simias wrote: post #111

I wish there was a solution for those of us who develop web interfaces for embedded products designed to live on LAN, often without any internet access and no well defined domain name. I'm all for HTTPS everywhere but right now for my products it's either: https with self-signed certificate, which basically makes any modern browser tell its user that they're in a very imminent danger of violent death should they deci…

let's encrypt with *.lan.mydomain.com via DNS validation, installed all over where needed, and annoying to update every 90 days because it's in weird/internal/non-standard places :)

Re: Chrome’s address bar will use https:// by default

#118

Post by boardwaalk »

simias wrote: post #111

I wish there was a solution for those of us who develop web interfaces for embedded products designed to live on LAN, often without any internet access and no well defined domain name. I'm all for HTTPS everywhere but right now for my products it's either: https with self-signed certificate, which basically makes any modern browser tell its user that they're in a very imminent danger of violent death should they deci…

It seems like we should have something like known_hosts for ssh, yeah. As long as it’s trusting one domain at a time (not a root CA), would it really be /that/ bad?

This and browser vendors being overbearing about extensions (I know they’re powerful) gets me down.

Re: Chrome’s address bar will use https:// by default

#119

Post by frcom »

greenwich26 wrote: post #102
paganel wrote: post #86

Earlier quoted context omitted.

That is a stupid idea, forcing https on people’s throats is a stupid idea generally speaking but it wouldn’t have been that bad if it hadn’t been forced on many people by what is basically a monopoly by this point.

HTTPS is such a scam. It's an obvious ploy to conquer the last corners of the web not yet under corporate control. But apparently calling it "Let's Encrypt" instead of "Let's make your website technically dependent on a Google/Mozilla/Amazon/Facebook-controlled service" is enough to fool people. It's totally obvious to me that, once HTTPS is mandatory, the next step will be that Let's Encrypt will stop supporting web…

And you can't just found a new SSL provider. The woke browsers need to accept its certificates.

In other words, something like the substack.com escape from the mainstream media won't work.

Post reply on HN