Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome’s address bar will use https:// by default

blog.chromium.org

Post reply on HN
Print view View original

241–250 of 463 posts

Re: Chrome’s address bar will use https:// by default

#241

Post by forgotmypw17 »

simias wrote: post #199
Wowfunhappy wrote: post #183

Earlier quoted context omitted.

I don't actually see the problem. If you're on a local network, there's no practical way to deal with certificates, so use http. Chrome will fall back. Problem solved. If http support ever gets truly removed, I will be very upset. But that hasn't happened, so what is there to complain about?

HTTP is effectively considered legacy by the big web actors these days. More and more APIs are HTTPS-only (often for good reasons) and the "insecure" warnings you get from using HTTP become more intrusive every year. The trajectory is pretty clear, the long term plan is to phase out HTTP completely. And I'm not against it, but I need a solution for LAN devices, and it doesn't exist at the moment because the big web a…

I AM against it, because it puts more centralized censorship power in the hands of the certificate authority.

Also, it completely cuts out "legacy" devices, basically anything more than 5 years old.

The Web is once again splitting into AOLized mainstream and "indie underground" that you have to make an effort to access.

Re: Chrome’s address bar will use https:// by default

#242

Post by Spivak »

maxk42 wrote: post #143
shadowgovt wrote: post #115

Earlier quoted context omitted.

Is it better for a free world to have the traffic be unencrypted? Feels like one head of the hydra is control of the cert-trust network, but another head is traffic-sniffing and monitoring one's online activity, yeah?

Please do not bring a straw man argument to the table. I clearly said " Until a central-authority-free alternative exists". Such alternatives are readily available and already used to secure e.g. ssh connections, but are not without drawbacks. One alternative that might be less likely to suffer from the same weaknesses as a certifcate-free model is a distributed certificate authority that relies on a ledger like DNS.

Those are the same thing. The CA system is a distributed X.500 database. It's the most distributed database in the world since the entries that comprise it are the certs themselves.

Moving the infrastructure to DNS wouldn't change the nature of the system, just which entities are at the root. Hell, the CA system right now delegates authority to domain registrars and the DNS system.

Re: Chrome’s address bar will use https:// by default

#243

Post by yunohn »

davidkhess wrote: post #184
simias wrote: post #111

I wish there was a solution for those of us who develop web interfaces for embedded products designed to live on LAN, often without any internet access and no well defined domain name. I'm all for HTTPS everywhere but right now for my products it's either: https with self-signed certificate, which basically makes any modern browser tell its user that they're in a very imminent danger of violent death should they deci…

Here's an approach I've used before successfully. It's not perfect but it's better than nothing. 1. Create your own root Certificate Authority. 2. Create a script using your favorite language and libraries that will create a new certificate for each device something along the lines of "myiotdevice-AABBCCDD.local". The AABBCCDD needs to be some sort of serialized number that's assigned during manufacturing and won't b…

I was looking into a similar approach, but wasn’t sure how to fix it for mobile devices and things like chrome cast. Any ideas?

Re: Chrome’s address bar will use https:// by default

#244

Post by tsimionescu »

rcdwealth wrote: post #216
Jarwain wrote: post #202

Earlier quoted context omitted.

The problem is that there is no way to deal with certs on a local network, but the OP would like to be able to use https anyways; http might be considered too insecure for their usecase

Make your own CA, install on each computer, install certificates, voila.

Repeat every 3 months or whenever the root certs expire.

Re: Chrome’s address bar will use https:// by default

#245

Post by tsimionescu »

bpye wrote: post #208
j1elo wrote: post #150

Earlier quoted context omitted.

I'm talking about the general state of HTTPS implantation. If you develop an offline device which offers a web UI, and it happens to use any feature that is deemed to require a Secure Context , you're out of luck. WebRTC is such a feature, but there are lots more, and they can change from one version of the browser to the next one. The players who are pushing so hard to shove HTTPS down our throats are simply closing…

Self-signed certificates seem reasonable in this context - unless I’m missing something.

They might to you, but the browser doesn't agree. It will scream with all its force to all your users that this accessing that product is a really really dangerous idea.

Re: Chrome’s address bar will use https:// by default

#246

Post by canadaduane »

The devcert tool (and its corresponding devcert-cli command-line interface) is very handy for creating a local root certificate authority that you control & your device trusts:

https://github.com/davewasmer/devcert https://github.com/davewasmer/devcert-cli

Benefits include no scare-screen, and being able to switch off all of your personally-generated certs at once by revoking the root auth.

Re: Chrome’s address bar will use https:// by default

#247

Post by Leherenn »

rcdwealth wrote: post #216
Jarwain wrote: post #202

Earlier quoted context omitted.

The problem is that there is no way to deal with certs on a local network, but the OP would like to be able to use https anyways; http might be considered too insecure for their usecase

Make your own CA, install on each computer, install certificates, voila.

Telling your clients to install your certificate in their computer/browser store is not very practical. And they will need to do that regularly.

Re: Chrome’s address bar will use https:// by default

#248

Post by beauzero »

simias wrote: post #111

I wish there was a solution for those of us who develop web interfaces for embedded products designed to live on LAN, often without any internet access and no well defined domain name. I'm all for HTTPS everywhere but right now for my products it's either: https with self-signed certificate, which basically makes any modern browser tell its user that they're in a very imminent danger of violent death should they deci…

An arguably "not finished" solution for me has been to ramp up adoption of IPFS and use Brave as a default until other browsers support it. It is speeding up my transition to full fledged adoption.

Re: Chrome’s address bar will use https:// by default

#249

Post by fluidcruft »

ohyeshedid wrote: post #185
fluidcruft wrote: post #51

Earlier quoted context omitted.

The biggest problem I'm having is that our edge firewall doesn't play nicely with it for some reason. I get these random websites that refuse to work in Firefox, but they always work fine in Chrome. And it's not certificate errors, it's just "connection reset by peer". I'm not entirely sure how it's working, but I've seen a few other people with these issues at the mozilla bug tracker and it's always just sort of eit…

I'm wondering if the tested Firefox install has enabled DoH?

Oh interesting. Firefox says it's both enabled and set to use 1.1.1.1, and I figured that nothing would resolve if it wasn't... but if https://1.1.1.1/help is correct then it's not actually working and something else is happening.

I know I tried setting and disabling that when I was testing but I saw no change. I don't remember setting 1.1.1.1 but I may have enabled DoH. I'll see if changing the DNS server in firefox to whatever everything else is using helps.

Edit:

It looks like Firefox just silently falls back to non-DoH system defaults if it's not working. Good to know, I guess. Not really sure what the point of DoH is if networks can just silently override the setting.

> Mozilla has announced plans to enable DoH for all Firefox desktop users in the United States in 2019. DoH will be enabled for users in “fallback” mode. For example, if the domain name lookups that are using DoH fail for some reason, Firefox will fall back and use the default DNS configured by the operating system (OS) instead of displaying an error.

https://support.mozilla.org/en-US/kb/firefox-dns-over-https

Re: Chrome’s address bar will use https:// by default

#250

Post by nitrogen »

capableweb wrote: post #177
fluidcruft wrote: post #170

Earlier quoted context omitted.

I 'm pretty confident that shows up as a certificate error with it's own scare page, not connection reset. Usually on cert errors you can click through all the warnings and accept the risks to connect anyway. Connection reset is just a complete dead end. I have pondered whether there's some way for the firewall to have a whitelist of sites that it allows without SSL MITM and otherwise sends reset for unknown SSL site…

> I 'm pretty confident Sounds like a engineers way of saying "I think it is like this, but I should double-check just in case" because who knows what the browser can show when something different happens? I don't know, I would check it at least.

"Connection reset by peer" usually means that either the remote host or an intermediate gateway/firewall sent a TCP RST packet, which is not used during normal connections. Wireshark should help figure this out -- it's a superpower for anyone working in dev or IT.
Post reply on HN