Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome’s address bar will use https:// by default

blog.chromium.org

Post reply on HN
Print view View original

321–330 of 463 posts

Re: Chrome’s address bar will use https:// by default

#321

Post by maxk42 »

bpye wrote: post #224
maxk42 wrote: post #64

I've said it many times, but nobody seems concerned: Certificate authorities are being used as tools of censorship by oppressive regimes. Until a central-authority-free alternative exists, the move to HTTPS is bad for a free world.

I understand that centralised CAs are not ideal, but how is HTTPS by default any worse than plaintext?

Simple: The oppressive regime in question can deny you a certificate thereby censoring you. Some also require you to use a particular certificate, thereby creating the illusion of security while being able to intercept, interdict, or MiTM information any time they like or continually. Here's an article that touches upon it superficially from 2010, and also notes that private companies are already selling these capabilities to authoritarian governments: https://arstechnica.com/information-technology/2010/03/govts...

Re: Chrome’s address bar will use https:// by default

#322

Post by EvangelicalPig »

simias wrote: post #111

I wish there was a solution for those of us who develop web interfaces for embedded products designed to live on LAN, often without any internet access and no well defined domain name. I'm all for HTTPS everywhere but right now for my products it's either: https with self-signed certificate, which basically makes any modern browser tell its user that they're in a very imminent danger of violent death should they deci…

On a related note, pinning the public keys of TLS certificates in browsers used to be a thing (HPKP) and it did mitigate certain classes of attacks with caveats (i.e, let's hijack a domain using an "incompetent" domain registrar and MITM clients that previously visited this site before, happens more than you think[1][2]).

Given how it was configured using HTTP headers and with the average site that has buggy webapps and such that could be used for header "injection" independent of the webserver it was unfortunately considered a theoretical persistent DoS vector, and thus removed from browsers.

I'm not convinced other solutions (CAA, CT) are adequate replacements because it best, they are reactive (versus preventative) solutions, and CAA assumes all CA's are properly checking DNS records at the time of issuance and that those DNS queries are not being intercepted, which is a big assumption in my book.

[1]: https://www.fox-it.com/en/news/blog/fox-it-hit-by-cyber-atta...

[2]: https://krebsonsecurity.com/2020/03/phish-of-godaddy-employe... (okay, was just a deface, but still accomplished with a hijacked registrar account)

Re: Chrome’s address bar will use https:// by default

#323

Post by jiehong »

netsec_burn wrote: post #240
jVinc wrote: post #168

What a journey it has been. http://www.example.com http://example.com https://example.com example.com We're finally getting there! Now just a decades to go and we'll reverse the order to get com.example After which we'll wait a couple of decades to decide we don't need TLDs as ICANN is instead just given a free pass to print any amount of money they want without that silly distraction. Then we'll be at just: example…

I've always thought reversing the order makes sense.

Yep, that’s called the FQDN (with a leading dot, so it’s .com.example)

Re: Chrome’s address bar will use https:// by default

#324

Post by stjohnswarts »

simias wrote: post #111

I wish there was a solution for those of us who develop web interfaces for embedded products designed to live on LAN, often without any internet access and no well defined domain name. I'm all for HTTPS everywhere but right now for my products it's either: https with self-signed certificate, which basically makes any modern browser tell its user that they're in a very imminent danger of violent death should they deci…

Now http will tell them that they are treading on thin ice and surely imminent death now :) . That's what firefox does.

Re: Chrome’s address bar will use https:// by default

#325

Post by kstrauser »

tomcooks wrote: post #295
forgotmypw17 wrote: post #241

Earlier quoted context omitted.

I AM against it, because it puts more centralized censorship power in the hands of the certificate authority. Also, it completely cuts out "legacy" devices, basically anything more than 5 years old. The Web is once again splitting into AOLized mainstream and "indie underground" that you have to make an effort to access.

Perfect time to radicalize the underground (say by beginning to experiment with Gemini or other protocols), the mainstream as usual only knows how to follow

Gemini requires TLS 1.2 or higher.

Re: Chrome’s address bar will use https:// by default

#326

Post by Macha »

0xCMP wrote: post #317
tomcooks wrote: post #297

Earlier quoted context omitted.

I wish there was a way to automate wildcard certs, at the moment I'm building a python script that logins to my domain registrar's panel and updates DNS records

let's encrypt supports wildcard certificates: https://community.letsencrypt.org/t/acme-v2-and-wildcard-cer...

If your domain provider's API sucks, or doesn't exist, or requires generating a password/key with more permissions than you're willing to give a script, look at acme-dns [1] and delegated DNS challenges:

https://github.com/joohoi/acme-dns

Re: Chrome’s address bar will use https:// by default

#327

Post by kstrauser »

jiehong wrote: post #323
netsec_burn wrote: post #240

Earlier quoted context omitted.

I've always thought reversing the order makes sense.

Yep, that’s called the FQDN (with a leading dot, so it’s .com.example)

An FQDN doesn't imply it's reversed: https://en.wikipedia.org/wiki/Fully_qualified_domain_name

I've never seen an FQDN written that way. It may be possible, but it definitely isn't common.

Re: Chrome’s address bar will use https:// by default

#328

Post by danShumway »

colllectorof wrote: post #313
danShumway wrote: post #80

Earlier quoted context omitted.

> The push towards forced HTTPS has significant costs, which most people in this filter bubble don't want to honestly discuss. I agree, but I'll push back by saying that delaying HTTPS adoption and getting lax about it has a much higher cost -- and that is similarly a cost that most people pushing back against HTTPS either downplay or refuse to acknowledge. And more than that, those critics have shown that they're no…

>And that has significant implications for people's privacy and security online. We're in a thread about Google making changes to Chrome . The irony of trying to somehow tie this to user privacy is hilarious.

Google is not the only company pushing for these changes, every mainstream browser is trying to increase HTTPS adoption. And you shouldn't be waiting for them to do so, you should already be running the HTTPS everywhere addon[0] in your browser today.

The overwhelming consensus in the security industry is that end-to-end encryption increases security and privacy. Overwhelmingly, security professionals recommend using HTTPS.

Of course it's tied to user privacy, there are multiple examples of not just malware authors but also corporations like Verizon, public wifi administrators for large establishments, doing sniffing and MITM attacks on non-HTTPS traffic. It's absurd that E2E encryption in the browser has to be defended to people, it is absolutely a privacy and security issue.

I dislike Google's privacy stances too; I'm regularly on the Google hate train. But if you're leaving your Internet traffic unencrypted just because Google is one of the companies telling you to encrypt, then you are pointlessly cutting off your nose to spite your face.

[0]: https://www.eff.org/https-everywhere

Re: Chrome’s address bar will use https:// by default

#329

Post by SV_BubbleTime »

cblconfederate wrote: post #190
jVinc wrote: post #168

What a journey it has been. http://www.example.com http://example.com https://example.com example.com We're finally getting there! Now just a decades to go and we'll reverse the order to get com.example After which we'll wait a couple of decades to decide we don't need TLDs as ICANN is instead just given a free pass to print any amount of money they want without that silly distraction. Then we'll be at just: example…

Actually we should have switched to resource locators that are just plain strings ("ycombinator news threads 26558305" . It s what google has been pushing everyone to do anyway (readable URLs), and what the centralization of the web led to ( fb / twitter usernames). Its easy for people to parse and speak through the phone, and it would be a decentralized, natural revival of AOL keywords. It would also drop total goog…

> Not sure where the protocol would fit though

A thousand twitchy heads just popped up, eyes narrowed then widened... a new protocol you say?!

Re: Chrome’s address bar will use https:// by default

#330

Post by ericbarrett »

shadowgovt wrote: post #277
j1elo wrote: post #271

Earlier quoted context omitted.

I'm talking about user access. At least other browsers still allow it (but that's also prone to change at the whims of the developers), but in Safari for iOS the page will fail silently and won't load, with absolutely no feedback as to why. Having to install custom-made Root CAs into all and every client device doesn't sound to me like an ideal solution...

Unfortunately, since one is breaking the SSL trust model, that's probably the right solution. Not unlike having to explicitly enable "Developer mode" before a whole host of security-breaking options are available. Actually, that's one solution Apple could consider: if a user has enabled Developer Mode on a given iOS device, allow the trust model to be broken with an "Are you sure you know what you're doing?" button i…

Scammers: "You have to enable developer mode to see our new bank website because it's in development"
Post reply on HN