Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome’s address bar will use https:// by default

blog.chromium.org

Post reply on HN
Print view View original

191–200 of 463 posts

Re: Chrome’s address bar will use https:// by default

#191

Post by MaxBarraclough »

boardwaalk wrote: post #118
simias wrote: post #111

I wish there was a solution for those of us who develop web interfaces for embedded products designed to live on LAN, often without any internet access and no well defined domain name. I'm all for HTTPS everywhere but right now for my products it's either: https with self-signed certificate, which basically makes any modern browser tell its user that they're in a very imminent danger of violent death should they deci…

It seems like we should have something like known_hosts for ssh, yeah. As long as it’s trusting one domain at a time (not a root CA), would it really be /that/ bad? This and browser vendors being overbearing about extensions (I know they’re powerful) gets me down.

> As long as it’s trusting one domain at a time (not a root CA), would it really be /that/ bad?

I think the unhappy reality is that yes, it would. In security terms it's a good thing the major browsers are extremely hostile to invalid HTTPS certs, and do not give the user an easy way to proceed (as somehnguy mentioned).

If you give the average user a simple Click to proceed, they will use it unthinkingly. Then, an invalid cert would no longer be a website-breaking catastrophe (which it absolutely should be), instead it would just be a strange pop-up that the user quickly forgets about, and the door is opened to bypassing the whole system of certificate-based security.

If you have the technical know-how, you already have the ability to customise the set of trusted certificates on your machine (with the possible exception of 'locked-down' mobile systems like iOS). The rest is a matter of UI.

> This and browser vendors being overbearing about extensions (I know they’re powerful) gets me down.

Similar situation. Unless carefully policed, browser extension stores can be used as attack vectors, and whether it's fair or not, the browser gets a bad reputation.

Re: Chrome’s address bar will use https:// by default

#192

Post by tgsovlerkhgsel »

colllectorof wrote: post #32
pornel wrote: post #13

That makes a lot of sense. HTTPS adoption is now very high[1], and this might push it a little bit further for sites that don't redirect to HTTPS automatically. I've been using Firefox in the experimental HTTPS-only mode, and the web is quite usable without cleartext HTTP. [1] https://transparencyreport.google.com/https/overview It's not a big change from security perspective though. HTTP requests shouldn't be gettin…

>HTTPS adoption is now very high[1] I posted this in a separate comment and I will post it again. https://certbot.eff.org/hosting_providers HTTPS adoption is hard enough that the wast majority of shared hosting providers haven't automated cert provisioning and are delegating this process to their users. The push towards forced HTTPS has significant costs, which most people in this filter bubble don't want to honestly…

The solution to that is to find a more competent hosting provider.

Re: Chrome’s address bar will use https:// by default

#193

Post by simias »

Spivak wrote: post #154
simias wrote: post #127

Earlier quoted context omitted.

I develop broadcast TV equipments which are often rented all over the place for short amounts of time, often don't have any direct internet access etc... I simply cannot make any assumption about the network these devices will run, and can certainly not rely on any sort of DNS validation. Virtually 100% of the time the devices are addressed directly by IPv4. I really can't think of a solution for this situation. For…

I think you would like how Plex did it. https://blog.filippo.io/how-plex-is-doing-https-for-all-its-...

That's quite a cool hack, but as I mentioned elsewhere in this discussion it's still a lot of infrastructure to let a user connect to a device on their own lan, and it still presupposes that the user will have a robust internet connection when they need to use the device.

That makes a lot of sense for Plex, but it's really not applicable for my equipment.

Re: Chrome’s address bar will use https:// by default

#194

Post by simias »

londons_explore wrote: post #134
simias wrote: post #127

Earlier quoted context omitted.

I develop broadcast TV equipments which are often rented all over the place for short amounts of time, often don't have any direct internet access etc... I simply cannot make any assumption about the network these devices will run, and can certainly not rely on any sort of DNS validation. Virtually 100% of the time the devices are addressed directly by IPv4. I really can't think of a solution for this situation. For…

DNS validation can entirely be done by a server on the internet, which does all the stuff necessary to get the certificate, and then gives the certificate to your end user device. All the end user device needs is a connection to the internet once per 90 days. The vast majority of networks have sufficient network connectivity for this.

I've literally never seen anybody use a domain name to address my devices, only a simple IPv4. That already makes it a nonstarter, but let's entertain the idea. Maybe I can convince my clients to change the way they work, they generally love that.

Just going through the trouble of having the customer mess with their OS's DNS resolver to connect to the device is ludicrous. Can you even do it on Windows without having to deal with the hosts file manually?

Then they need to remember to update it when the IP inevitably changes because they've moved onto a new project with a different address plan, and they'll invariably forget to change it or forget how to do it or do it wrong and then call me to help them.

And on top of all that, no I can't really expect my devices to have internet access, not even once every 60 days. It's not uncommon for broadcast operations to use costly and critical satellite links for internet access, and they're not going to let random devices use that without a good reason. More generally, even if there's an internet connection available they're likely not to configure the gateway correctly, then complain when the night of the big event their browser refuses to connect to my equipment, saying that they're about to be h4x0r3d.

My use case is certainly a niche, but I think it's probably a significant niche given that everything and anything has web interfaces these days. Cameras have web interfaces for configuration, middle end smart switches and routers have web interfaces, I've even seen power plugs with web interfaces...

Re: Chrome’s address bar will use https:// by default

#195

Post by INTPenis »

simias wrote: post #111

I wish there was a solution for those of us who develop web interfaces for embedded products designed to live on LAN, often without any internet access and no well defined domain name. I'm all for HTTPS everywhere but right now for my products it's either: https with self-signed certificate, which basically makes any modern browser tell its user that they're in a very imminent danger of violent death should they deci…

Yeah I came here to say just that. It's really annoying when Firefox is stuck on https for some reason, maybe history? So I have to test if one of my LAN services works with curl.

I think it has to do with history so I have to clear all history for that site and then start using it with http and it should work fine. This is only Firefox.

Re: Chrome’s address bar will use https:// by default

#196

Post by billpg »

simias wrote: post #111

I wish there was a solution for those of us who develop web interfaces for embedded products designed to live on LAN, often without any internet access and no well defined domain name. I'm all for HTTPS everywhere but right now for my products it's either: https with self-signed certificate, which basically makes any modern browser tell its user that they're in a very imminent danger of violent death should they deci…

Browsers would need to be modified, but I wonder if TOR's method of URLs with the public key encoded could be repurposed for devices on a LAN?

https://hashhash.lan/

(Causes browser to broadcast a message on LAN and wait for a response. Keys are exchanged and if valid, completes connection.)

Devices would need to be programmed with a private key at the factory and print out a QR with the encoded hash and stick it somewhere discreet.

What's that? The factory is producing devices all with the same private key to save money? This is why we can't have nice things.

Re: Chrome’s address bar will use https:// by default

#197

Post by danShumway »

simias wrote: post #111

I wish there was a solution for those of us who develop web interfaces for embedded products designed to live on LAN, often without any internet access and no well defined domain name. I'm all for HTTPS everywhere but right now for my products it's either: https with self-signed certificate, which basically makes any modern browser tell its user that they're in a very imminent danger of violent death should they deci…

The very partial solution that I've been experimenting with and trying to refine is to "abuse" DNS records and Certbot's DNS tests so that I can have a bunch of public subdomains that point at intranet sites.[0] There's no rule that says you can't point a DNS record at a local IP.

This really isn't a full solution though because there are instances where you don't want a public DNS record at all. It's also not particularly plug and play, at least right now. And it requires you to have a static domain name and an Internet connection.

It's a step in the right direction, but not perfect, and not usable in every situation. Setting up a custom certificate server and configuring every device is a no-go for me, maybe that works for highly managed networks. I don't trust myself to do it, and even if I did, it's too time consuming and annoying to set up for new devices. At least with my current setup I don't need to transfer any information (other than the DNS lookup) out of my network, and anyone and any device on my network will immediately be able to connect to whatever service I have, and I don't need to worry about accidentally compromising every website I visit.

I'm not sure what the better solution would be. I'd also be interested in hearing ideas about this, it's a problem I'm running into as I try to figure out how to get HTTPS encryption on my local projects. And I do want HTTPS on those projects. I don't want my local network to be running everything unencrypted just because it's behind a LAN. But it's very tricky to try and set something up that's both robust and dependable, and that is fast enough to be usable within 1-2 minutes of me starting a new project that I'm just hacking on.

It's also something that we're thinking about at work. We'd love to manage HTTPS for software installations on our client networks, but we don't want to force them to reveal too much info about their networks on the public Internet, and we don't want to deal with trying to integrate with whatever weird, half-broken certificate servers they have running.

[0]: https://danshumway.com/blog/encrypting-internal-networks/

Re: Chrome’s address bar will use https:// by default

#198

Post by spurgu »

dcow wrote: post #166
j1elo wrote: post #150

Earlier quoted context omitted.

I'm talking about the general state of HTTPS implantation. If you develop an offline device which offers a web UI, and it happens to use any feature that is deemed to require a Secure Context , you're out of luck. WebRTC is such a feature, but there are lots more, and they can change from one version of the browser to the next one. The players who are pushing so hard to shove HTTPS down our throats are simply closing…

Yeah, I think we need a browser that isn't developed by companies with vested interests in having all your traffic go to them...

Then again I think Google would do just fine even if Firefox was the only browser.

Re: Chrome’s address bar will use https:// by default

#199

Post by simias »

Wowfunhappy wrote: post #183
j1elo wrote: post #150

Earlier quoted context omitted.

I'm talking about the general state of HTTPS implantation. If you develop an offline device which offers a web UI, and it happens to use any feature that is deemed to require a Secure Context , you're out of luck. WebRTC is such a feature, but there are lots more, and they can change from one version of the browser to the next one. The players who are pushing so hard to shove HTTPS down our throats are simply closing…

I don't actually see the problem. If you're on a local network, there's no practical way to deal with certificates, so use http. Chrome will fall back. Problem solved. If http support ever gets truly removed, I will be very upset. But that hasn't happened, so what is there to complain about?

HTTP is effectively considered legacy by the big web actors these days. More and more APIs are HTTPS-only (often for good reasons) and the "insecure" warnings you get from using HTTP become more intrusive every year.

The trajectory is pretty clear, the long term plan is to phase out HTTP completely. And I'm not against it, but I need a solution for LAN devices, and it doesn't exist at the moment because the big web actors do everything in the cloud these days and they don't care about this use case.

Re: Chrome’s address bar will use https:// by default

#200

Post by airstrike »

Symbiote wrote: post #105
throwaway287391 wrote: post #76

Earlier quoted context omitted.

I hate that editing URLs is practically impossible in Chrome on iOS (not sure about Android or other iOS browsers). There seems to be no equivalent of arrow keys to navigate around inside the address bar. If I screeenmash enough I think I can sometimes get it to go to the very start or end of the URL, but anything in between is hopeless. (Posting this partially in hopes that someone tells me how to do it to prove me…

Are there ways to get the keyboard to have cursor keys, or something similar? I use the Microsoft Swiftkey keyboard on Android, and there's a setting which makes holding the space button activate gestures for up/down/left/right. (i.e. hold space and move small amounts left/right.) If you have enough screen space, I think you can add real arrow keys. But I'm not sure you can change the keyboard on iOS.

I've been using SwiftKey on iOS for about half a decade, I think.

The native iOS keyboard also lets you move the cursor by long-pressing / 3d-pressing anywhere on the keyboard and then swiping slowly in any direction

Post reply on HN