Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome’s address bar will use https:// by default

blog.chromium.org

Post reply on HN
Print view View original

251–260 of 463 posts

Re: Chrome’s address bar will use https:// by default

#251

Post by jamespharaoh »

simias wrote: post #203
MaxBarraclough wrote: post #178

Earlier quoted context omitted.

On the face of it, it sounds simple enough: special treatment when the IP address is an IETF-designated private IPv4 address (e.g. 192.168.x.y). Is there some reason this wouldn't work, that I haven't thought of?

I considered that, but I think at the moment there's no concept of IP address for web certificates, it's all based on domain names as far as I know. It doesn't mean it's not doable of course, but I could understand if it make people uneasy since it means that the same domain and the same certificate would behave differently depending on what it resolves to. It may be an interesting solution to consider though. That w…

You absolutely can get a certificate for an IP address. Clients should verify them based on the common name, and a subject alternative name has various field types including IP address.

A quick Google search shows various certificate authorities who will issue certificates for IP addresses.

Re: Chrome’s address bar will use https:// by default

#253

Post by OskarS »

0x0 wrote: post #89
OskarS wrote: post #61

Earlier quoted context omitted.

I agree! The protocol is not particularly interesting information, as long as it indicates secure vs. non-secure connection somehow. As long as it comes along when you copy the URL, it's fine. The bad version of this trend is when you hide the path after the domain like Safari does. That's awful design, that's a very relevant part of the URL!

It's quite annoying when the https:// prefix is hidden but then appears in copy-paste. Quite often I'd like to run things like "host -t mx " or "whois " and then it also copies the invisible " https:// " prefix which is incorrect for these use cases.

https://xkcd.com/1172/

Re: Chrome’s address bar will use https:// by default

#254

Post by macintux »

MaxBarraclough wrote: post #178
franga2000 wrote: post #169

Earlier quoted context omitted.

Yeah, there really needs to be a "secure, but not trusted" mode. My suggestion would be add a "trusted-only" TXT DNS entry that a browser could check when presented with an untrusted connection. HTTP: gray broken padlock HTTPS+Cert: green padlock HTTPS+no cert: gray padlock HTTPS+no cert+trusted-only: red broken padlock Any complaints? No? Ok, let's make it a standard! Oh wait... we're not in control of the standard,…

On the face of it, it sounds simple enough: special treatment when the IP address is an IETF-designated private IPv4 address (e.g. 192.168.x.y). Is there some reason this wouldn't work, that I haven't thought of?

There are companies who’ve been using public IPs on their intranet for decades, however.

Re: Chrome’s address bar will use https:// by default

#255

Post by bodhi_mind »

simias wrote: post #111

I wish there was a solution for those of us who develop web interfaces for embedded products designed to live on LAN, often without any internet access and no well defined domain name. I'm all for HTTPS everywhere but right now for my products it's either: https with self-signed certificate, which basically makes any modern browser tell its user that they're in a very imminent danger of violent death should they deci…

Could always ship your browser.

Re: Chrome’s address bar will use https:// by default

#256

Post by tmm »

simias wrote: post #111

I wish there was a solution for those of us who develop web interfaces for embedded products designed to live on LAN, often without any internet access and no well defined domain name. I'm all for HTTPS everywhere but right now for my products it's either: https with self-signed certificate, which basically makes any modern browser tell its user that they're in a very imminent danger of violent death should they deci…

I think the solution is TLS-PSK[0]. But browsers don't support pre-shared key mode. If they did, each IoT device (or consumer router, NAS, etc) could ship with a unique key which your browser could prompt for on first use. These could be even be managed by password managers, so you'd get the trust on all your devices.

Why isn't this a thing?

[0] https://en.wikipedia.org/wiki/TLS-PSK

Re: Chrome’s address bar will use https:// by default

#257

Post by smokey_circles »

simias wrote: post #111

I wish there was a solution for those of us who develop web interfaces for embedded products designed to live on LAN, often without any internet access and no well defined domain name. I'm all for HTTPS everywhere but right now for my products it's either: https with self-signed certificate, which basically makes any modern browser tell its user that they're in a very imminent danger of violent death should they deci…

>I wish there was a solution for those of us who develop web interfaces for embedded products designed to live on LAN, often without any internet access and no well defined domain name.

Don't use the browser?

I understand the temptation to use the browser, but this is the price you pay for using someone else's platform: They're free to close whatever door they want.

HTML renderers are dime a dozen. Electron is a thing. Serve the HTML using _another_renderer.

JavaFX isn't bad either but I'm not gonna sell anyone on that front because I don't even do it, but the option is there.

Please stop using my browser in obscure and painful ways just so you can (understandably) avoid having to write a native UI.

Re: Chrome’s address bar will use https:// by default

#258

Post by goodside »

This is a great instance of https://xkcd.com/1172/ for me. "example.com" is the only domain name I intentionally load over HTTP in Chrome, so this change breaks my workflow.

Many for-pay wifi networks (e.g. on airplanes) are designed to intercept all HTTP requests from guest users, redirecting the browser to a login/signup page. Until you log in HTTPS is blocked, so you have to try to open a domain Chrome doesn't recognize as requiring HTTPS. There are fewer of these every year, so I use "example.com" because it autocompletes easily and will be around forever. Now there's no domain that works, and you have to type every character of "http://a" to get the same result.

Re: Chrome’s address bar will use https:// by default

#259

Post by chpatrick »

tsimionescu wrote: post #245
bpye wrote: post #208

Earlier quoted context omitted.

Self-signed certificates seem reasonable in this context - unless I’m missing something.

They might to you, but the browser doesn't agree. It will scream with all its force to all your users that this accessing that product is a really really dangerous idea.

You can set up the users' machines so that they trust your certificate.

Re: Chrome’s address bar will use https:// by default

#260

Post by wp381640 »

CydeWeys wrote: post #225
tptacek wrote: post #222

Earlier quoted context omitted.

There's no such thing as "secure, but not trusted". The security depends on the trust. That isn't just how TLS works; it's how all secure key exchanges work.

s/secure/encrypted/ ?

There’s little point in encrypting if you’re not authenticating
Post reply on HN