Chrome’s address bar will use https:// by default • Hacker News Board

Re: Chrome’s address bar will use https:// by default

#291

Post by heinrichhartman » Tue, Mar 23, 2021, 9:01 PM UTC

chpatrick wrote: post #259

tsimionescu wrote: post #245

Earlier quoted context omitted.

They might to you, but the browser doesn't agree. It will scream with all its force to all your users that this accessing that product is a really really dangerous idea.

You can set up the users' machines so that they trust your certificate.

I have tried to do just that but ran into all kinds of difficulties:

1. Overhead: I have 5 devices that I own 3 of my wife and a smart TV. Setting all this us takes a lot of time, even if it worked fine.

2. What about visitors to my home, that I want to give access? They need the cert as well together with lengthy instructions on how to install it.

3. How do I even install certs on an iPhone?

4. Firefox uses it's own Certificate Database -- for each profile. So I'll have to install certs on the system AND on the host (for e.g. Chrome to find it).

5. All these steps need to be repeated every year (90 days?!) depending on the cert expiration period.

Eventually I just gave up on this. It's not practical. There needs to be a better solution.

Re: Chrome’s address bar will use https:// by default

#292

Post by jodrellblank » Tue, Mar 23, 2021, 9:05 PM UTC

tsimionescu wrote: post #244

rcdwealth wrote: post #216

Earlier quoted context omitted.

Make your own CA, install on each computer, install certificates, voila.

Repeat every 3 months or whenever the root certs expire.

3 months? I must have updated FireFox / Discord / VS Code /etc. about a hundred times in last 3 months. Plenty for them to add renewed SSL whatevers inside one of the updates.

Re: Chrome’s address bar will use https:// by default

#293

Post by mastre_ » Tue, Mar 23, 2021, 9:06 PM UTC

I feel like I'm asking the obvious, but.. is it that hard to mention a date when you're going to break a bunch of stuff, so those affected at least know how long they have to look for contingency plans? For those who don't know how long it takes for a Chrome version to move from dev (v90 is there now) to prod it would be nice to have an idea, is it a week/month/90 days?

Re: Chrome’s address bar will use https:// by default

#294

Post by chc » Tue, Mar 23, 2021, 9:07 PM UTC

forgotmypw17 wrote: post #241

simias wrote: post #199

Earlier quoted context omitted.

HTTP is effectively considered legacy by the big web actors these days. More and more APIs are HTTPS-only (often for good reasons) and the "insecure" warnings you get from using HTTP become more intrusive every year. The trajectory is pretty clear, the long term plan is to phase out HTTP completely. And I'm not against it, but I need a solution for LAN devices, and it doesn't exist at the moment because the big web a…

I AM against it, because it puts more centralized censorship power in the hands of the certificate authority. Also, it completely cuts out "legacy" devices, basically anything more than 5 years old. The Web is once again splitting into AOLized mainstream and "indie underground" that you have to make an effort to access.

Who is "the certificate authority" you're referring to here?

Re: Chrome’s address bar will use https:// by default

#295

Post by tomcooks » Tue, Mar 23, 2021, 9:07 PM UTC

forgotmypw17 wrote: post #241

simias wrote: post #199

Earlier quoted context omitted.

HTTP is effectively considered legacy by the big web actors these days. More and more APIs are HTTPS-only (often for good reasons) and the "insecure" warnings you get from using HTTP become more intrusive every year. The trajectory is pretty clear, the long term plan is to phase out HTTP completely. And I'm not against it, but I need a solution for LAN devices, and it doesn't exist at the moment because the big web a…

I AM against it, because it puts more centralized censorship power in the hands of the certificate authority. Also, it completely cuts out "legacy" devices, basically anything more than 5 years old. The Web is once again splitting into AOLized mainstream and "indie underground" that you have to make an effort to access.

Perfect time to radicalize the underground (say by beginning to experiment with Gemini or other protocols), the mainstream as usual only knows how to follow

Re: Chrome’s address bar will use https:// by default

#296

Post by xg15 » Tue, Mar 23, 2021, 9:08 PM UTC

Spivak wrote: post #230

simias wrote: post #194

Earlier quoted context omitted.

I've literally never seen anybody use a domain name to address my devices, only a simple IPv4. That already makes it a nonstarter, but let's entertain the idea. Maybe I can convince my clients to change the way they work, they generally love that. Just going through the trouble of having the customer mess with their OS's DNS resolver to connect to the device is ludicrous. Can you even do it on Windows without having…

I don't think Let's Encrypt is going to be the right use-case for you then. I think your best bet is to work with another CA to get your company an intermediate cert that you can use to issue longer certs that include ip addresses in the SAN. Then it's just a matter of the devices connecting to the internet at least once a year and doing a very simple "Hey, I'm $device and using $address. Issue me a cert plz."

> work with another CA to get your company an intermediate cert

I'm no expert, but wouldn't that make GP's company effectively a delegate CA? This seems like it would need a very close relationship with the original CA - and all just for a simple web interface.

> include ip addresses in the SAN.

Not sure if this may be different with intermediate certs, but you won't find any public CA that will add private IP addresses as a SAN - as this would undermine the whole security model. If any CA did this, Chrome would likely ban them quickly.

I'm sceptical a CA would let you do that with intermediate certs if there is any danger the leaf certs get into the wrong hands (e.g. because the devices are sold, someone reverse-engeneers one and manages to talk to the back-end service)

Re: Chrome’s address bar will use https:// by default

#297

Post by tomcooks » Tue, Mar 23, 2021, 9:09 PM UTC

kuon wrote: post #228

Jarwain wrote: post #202

Earlier quoted context omitted.

The problem is that there is no way to deal with certs on a local network, but the OP would like to be able to use https anyways; http might be considered too insecure for their usecase

What I do is buy localme.xyz and get a wildcard cert via DNS validation. This way you get SSL for offline devices. But you need to update the cert periodically.

I wish there was a way to automate wildcard certs, at the moment I'm building a python script that logins to my domain registrar's panel and updates DNS records

Re: Chrome’s address bar will use https:// by default

#298

Post by tptacek » Tue, Mar 23, 2021, 9:09 PM UTC

lazyweb wrote: post #226

tptacek wrote: post #222

Earlier quoted context omitted.

There's no such thing as "secure, but not trusted". The security depends on the trust. That isn't just how TLS works; it's how all secure key exchanges work.

That's exactly how mail works between servers though. Granted, it's about semantics, but virtually all mail servers accept TLS connections without the need to check cert validity of their respective counterparts.

Yes: encryption does not work in multi-hop SMTP email. Email is not a secure messaging system, and it is difficult to even build a novel secure messaging system on top of it.

Client-server TLS has a goal of actually thwarting adversaries. SMTP encryption is mostly about raising the costs of adversaries (I think there's plusses and minuses with this strategy; to some threshold, increasing costs for the US IC is actually helping them, organizationally, because the IC's real primary goal is budget-seeking).

Re: Chrome’s address bar will use https:// by default

#299

Post by tptacek » Tue, Mar 23, 2021, 9:11 PM UTC

franga2000 wrote: post #237

tptacek wrote: post #222

Earlier quoted context omitted.

There's no such thing as "secure, but not trusted". The security depends on the trust. That isn't just how TLS works; it's how all secure key exchanges work.

That is very obviously not the case. A self-signed certificate protects data from being intercepted and read just as well as a signed one. The only thing "valid" certs protect from that self-signed certs don't is impersonation. In the case of an intranet or local embedded device, if someone can MITM your connection, you're already screwed - and either way, your are just as screwed getting MITMd with an unchecked cert…

One of the basic jobs of a secure transport is to prevent MITM attacks. MITM attacks are the modal attack on TLS. It's not 1995 anymore. Nobody's using solsniff.c.

Re: Chrome’s address bar will use https:// by default

#300

Post by NickNameNick » Tue, Mar 23, 2021, 9:11 PM UTC

qwertox wrote: post #278

j1elo wrote: post #136

Earlier quoted context omitted.

It's worrying how they are improving the case for "70%" scenarios, while crippling it for the other 30%, without recourse. It's not even funny any more. What happens with offline LAN? And the ideal IoT devices that we would all want to have? (I mean those we dream about in all IoT HN posts, where the rants typically are that no internet connection should be needed for most of these kinds of devices) What about offlin…

> It's worrying how they are improving the case for "70%" scenarios, while crippling it for the other 30%, without recourse. It's not even funny any more. I constantly have issues with this address bar hiding the scheme and even the www. One issue is when I quickly want to select some parameters or delete parts of the url in order to "up" one level. What drives me absolutely insane is their inconsitent autocomplete f…

It's a silly hack, but if you install googles "Suspicious site reporter" extension for chrome, then the chrome address bar retains the full URL all the time.