Could we get it to stop searching Google from inside the datacenter though
Chrome’s address bar will use https:// by default
231–240 of 463 posts
Re: Chrome’s address bar will use https:// by default
#232Earlier quoted context omitted.
Here's an approach I've used before successfully. It's not perfect but it's better than nothing. 1. Create your own root Certificate Authority. 2. Create a script using your favorite language and libraries that will create a new certificate for each device something along the lines of "myiotdevice-AABBCCDD.local". The AABBCCDD needs to be some sort of serialized number that's assigned during manufacturing and won't b…
So then I have to install a root CA for every random IoT product I buy? Which also entails handing them the keys to my machine, since being a root CA means any certificate they generate will be trusted.
[deleted]
Re: Chrome’s address bar will use https:// by default
#233I wish there was a solution for those of us who develop web interfaces for embedded products designed to live on LAN, often without any internet access and no well defined domain name. I'm all for HTTPS everywhere but right now for my products it's either: https with self-signed certificate, which basically makes any modern browser tell its user that they're in a very imminent danger of violent death should they deci…
> "I'm all for HTTPS everywhere but right now for my products it's either: https with self-signed certificate, which basically makes any modern browser tell its user that they're in a very imminent danger of violent death should they decide to proceed, or just go with good old HTTP but then you hit all sorts of limitations, and obviously zero security." How about what Plex did for its self-hosted media servers? "Firs…
How does the client learn the full domain name (the one with the hash)?
Re: Chrome’s address bar will use https:// by default
#234I wish there was a solution for those of us who develop web interfaces for embedded products designed to live on LAN, often without any internet access and no well defined domain name. I'm all for HTTPS everywhere but right now for my products it's either: https with self-signed certificate, which basically makes any modern browser tell its user that they're in a very imminent danger of violent death should they deci…
It's funny how pushing stringent privacy and security defaults in one domain degrades the privacy and security experience in another domain. My jaded takeaway from the last 5 or so years is that the internet companies (understandably) don't care about non-internet experiences. I empathize with how annoying that reality is because internet technology certainly works locally if you configure everything correctly.. just…
Picking specifically on the claim that IPv6 doesn't degrade user privacy.
In an IPv4 + NAT overload residential network, google can see 10 different accounts logging in from a single IP address.
In an IPv6 + privacy-extention-addressing residential network, google can see the unique IPv6 used for each address, and concludes that since five of these 10 accounts are coming from the same IPv6 address, and the other five are coming from five different distinct addresses.
That's more than it was able to glean before.
IPv6 was designed at a time when NAT was a hack to extend address space, before we had pervasive surveillance on the internet. IPv6 privacy extension addressing is a hack to try and address the fact that we now have pervasive surveillence on the internet.
Privacy properties of IPv4 NAT overloading was by chance rather than by design, but tragically the IPv6 privacy extentions are worse by design, than by chance.
Re: Chrome’s address bar will use https:// by default
#235What a journey it has been. http://www.example.com http://example.com https://example.com example.com We're finally getting there! Now just a decades to go and we'll reverse the order to get com.example After which we'll wait a couple of decades to decide we don't need TLDs as ICANN is instead just given a free pass to print any amount of money they want without that silly distraction. Then we'll be at just: example…
Reminds me of this story [1] from a few days ago (emoji domain names). It's going to be thing sooner or later.
Re: Chrome’s address bar will use https:// by default
#236Earlier quoted context omitted.
It's worrying how they are improving the case for "70%" scenarios, while crippling it for the other 30%, without recourse. It's not even funny any more. What happens with offline LAN? And the ideal IoT devices that we would all want to have? (I mean those we dream about in all IoT HN posts, where the rants typically are that no internet connection should be needed for most of these kinds of devices) What about offlin…
Is it the case that self-signed certs don't work in iOS at all? I'm looking around, and I appear to see tutorials for how to properly configure one in iOS. https://medium.com/collaborne-engineering/self-signed-certif...
Yeah, I don't know what OP is talking about, I'm using one on my iPhone right now. Enterprises deploy them all the time.
It is true, that in recent versions of iOS (in the past five years or so), you have to install the certificate in Safari, then go to Settings->General->About, scroll all the way down, and manually trust the certificate (to ensure you really know what you're doing by enabling it). And iOS doesn't make this known anywhere outside of that special menu three levels deep, I suppose to not confuse people who had an attacker install a cert on their phone somehow.
Re: Chrome’s address bar will use https:// by default
#237Earlier quoted context omitted.
Yeah, there really needs to be a "secure, but not trusted" mode. My suggestion would be add a "trusted-only" TXT DNS entry that a browser could check when presented with an untrusted connection. HTTP: gray broken padlock HTTPS+Cert: green padlock HTTPS+no cert: gray padlock HTTPS+no cert+trusted-only: red broken padlock Any complaints? No? Ok, let's make it a standard! Oh wait... we're not in control of the standard,…
There's no such thing as "secure, but not trusted". The security depends on the trust. That isn't just how TLS works; it's how all secure key exchanges work.
That is very obviously not the case. A self-signed certificate protects data from being intercepted and read just as well as a signed one. The only thing "valid" certs protect from that self-signed certs don't is impersonation. In the case of an intranet or local embedded device, if someone can MITM your connection, you're already screwed - and either way, your are just as screwed getting MITMd with an unchecked cert as you are with no encryption. The difference is, that without any encryption, an attacker doesn't even need to MITM you - they can just sit quietly and snoop on your packets.
Re: Chrome’s address bar will use https:// by default
#238I wish there was a solution for those of us who develop web interfaces for embedded products designed to live on LAN, often without any internet access and no well defined domain name. I'm all for HTTPS everywhere but right now for my products it's either: https with self-signed certificate, which basically makes any modern browser tell its user that they're in a very imminent danger of violent death should they deci…
Seems like a browser could treat the scenario when a user types an IP address differently from a normal domain name resolution (eg even just changing the messaging to be less scary).
If you're actually using domain names on your LAN maybe you just have to bite the bullet and sign certificates too. You don't need internet access to have a properly signed certificate.
Re: Chrome’s address bar will use https:// by default
#239Earlier quoted context omitted.
It's worrying how they are improving the case for "70%" scenarios, while crippling it for the other 30%, without recourse. It's not even funny any more. What happens with offline LAN? And the ideal IoT devices that we would all want to have? (I mean those we dream about in all IoT HN posts, where the rants typically are that no internet connection should be needed for most of these kinds of devices) What about offlin…
Is it the case that self-signed certs don't work in iOS at all? I'm looking around, and I appear to see tutorials for how to properly configure one in iOS. https://medium.com/collaborne-engineering/self-signed-certif...
I'm using self signed cert on iOS/macOS and it works just fine with Safari. Safari is messed up in other ways with TLS. Like it re-uses HTTP2 connections when making requests for a different Host when it's running on the same IP address as the host it connected to previously, which completely breaks client certificate selection and unless you recompile nginx with custom patches, it also doesn't work with nginx, because SNI and actual Host header differ, which nginx doesn't like by default.
Re: Chrome’s address bar will use https:// by default
#240What a journey it has been. http://www.example.com http://example.com https://example.com example.com We're finally getting there! Now just a decades to go and we'll reverse the order to get com.example After which we'll wait a couple of decades to decide we don't need TLDs as ICANN is instead just given a free pass to print any amount of money they want without that silly distraction. Then we'll be at just: example…
I've always thought reversing the order makes sense.