Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome’s address bar will use https:// by default

blog.chromium.org

Post reply on HN
Print view View original

341–350 of 463 posts

Re: Chrome’s address bar will use https:// by default

#341

Post by Wowfunhappy »

ericbarrett wrote: post #330
shadowgovt wrote: post #277

Earlier quoted context omitted.

Unfortunately, since one is breaking the SSL trust model, that's probably the right solution. Not unlike having to explicitly enable "Developer mode" before a whole host of security-breaking options are available. Actually, that's one solution Apple could consider: if a user has enabled Developer Mode on a given iOS device, allow the trust model to be broken with an "Are you sure you know what you're doing?" button i…

Scammers: "You have to enable developer mode to see our new bank website because it's in development"

At that point, isn’t it easier to send the user to chase.com.scammer.com?

The goal isn’t to make a 100% foolproof system (because you can’t), and needing to flip a switch called “developer mode”, which preferably also displays a warning message, should make it clear something is wrong.

...I think this whole discussion is kind of missing the point though. Developers are not the only people who need to log in to routers.

Re: Chrome’s address bar will use https:// by default

#342

Post by jjoonathan »

jussij wrote: post #332
chc wrote: post #294

Earlier quoted context omitted.

Who is "the certificate authority" you're referring to here?

The OP means that in using https (and being forced to used https) you are also being forced into paying a 'third party' an annual fee just to get a valid certificate. That 'third party' is one of the recognized 'certificate authorities'. But the OPs point is by going https, you don't have a choice, you have to pay the certificate tax.

Right, and Let's Encrypt doesn't solve the problem, it just kicks the can to DNS, which is globally unique and costs money. Communicating between your computer and any device that you supposedly own without the slow, unnecessary, and increasingly intrusive permission of some cloud IoT stack will become more and more difficult.

Re: Chrome’s address bar will use https:// by default

#343

Post by [deleted] »

jussij wrote: post #332
chc wrote: post #294

Earlier quoted context omitted.

Who is "the certificate authority" you're referring to here?

The OP means that in using https (and being forced to used https) you are also being forced into paying a 'third party' an annual fee just to get a valid certificate. That 'third party' is one of the recognized 'certificate authorities'. But the OPs point is by going https, you don't have a choice, you have to pay the certificate tax.

[deleted]

Re: Chrome’s address bar will use https:// by default

#344

Post by yakubin »

kstrauser wrote: post #325
tomcooks wrote: post #295

Earlier quoted context omitted.

Perfect time to radicalize the underground (say by beginning to experiment with Gemini or other protocols), the mainstream as usual only knows how to follow

Gemini requires TLS 1.2 or higher.

But it doesn't rely on CAs. It relies on TOFU.

Re: Chrome’s address bar will use https:// by default

#345

Post by marshray »

pishpash wrote: post #316
tsimionescu wrote: post #245

Earlier quoted context omitted.

They might to you, but the browser doesn't agree. It will scream with all its force to all your users that this accessing that product is a really really dangerous idea.

Maybe it is a dangerous idea. You could be snooping on them for all they know. A little truth never hurts.

There is an important difference between (A) trusting "just this one" cert for a specific reason, and (B) installing a root cert that is able to impersonate any server.

It ought to be a practical to do (A) without doing (B), but due to a variety of deep human and technical problems, it isn't.

Re: Chrome’s address bar will use https:// by default

#346

Post by isignal »

jussij wrote: post #332
chc wrote: post #294

Earlier quoted context omitted.

Who is "the certificate authority" you're referring to here?

The OP means that in using https (and being forced to used https) you are also being forced into paying a 'third party' an annual fee just to get a valid certificate. That 'third party' is one of the recognized 'certificate authorities'. But the OPs point is by going https, you don't have a choice, you have to pay the certificate tax.

This is not true, you can set your host to trust a self signed certificate without much difficulty. Check out this tool for example https://github.com/FiloSottile/mkcert (prev discussion at https://news.ycombinator.com/item?id=17748208)

Re: Chrome’s address bar will use https:// by default

#347

Post by isignal »

heinrichhartman wrote: post #291
chpatrick wrote: post #259

Earlier quoted context omitted.

You can set up the users' machines so that they trust your certificate.

I have tried to do just that but ran into all kinds of difficulties: 1. Overhead: I have 5 devices that I own 3 of my wife and a smart TV. Setting all this us takes a lot of time, even if it worked fine. 2. What about visitors to my home, that I want to give access? They need the cert as well together with lengthy instructions on how to install it. 3. How do I even install certs on an iPhone? 4. Firefox uses it's own…

https://news.ycombinator.com/item?id=17748208

I found the steps described in https://github.com/FiloSottile/mkcert reasonable to follow. It describes an iOS workflow too.

Re: Chrome’s address bar will use https:// by default

#348

Post by dbbk »

mastre_ wrote: post #293

I feel like I'm asking the obvious, but.. is it that hard to mention a date when you're going to break a bunch of stuff, so those affected at least know how long they have to look for contingency plans? For those who don't know how long it takes for a Chrome version to move from dev (v90 is there now) to prod it would be nice to have an idea, is it a week/month/90 days?

This change doesn’t break anything? It’s entirely backwards compatible.

Re: Chrome’s address bar will use https:// by default

#350

Post by marshray »

tmm wrote: post #256
simias wrote: post #111

I wish there was a solution for those of us who develop web interfaces for embedded products designed to live on LAN, often without any internet access and no well defined domain name. I'm all for HTTPS everywhere but right now for my products it's either: https with self-signed certificate, which basically makes any modern browser tell its user that they're in a very imminent danger of violent death should they deci…

I think the solution is TLS-PSK[0]. But browsers don't support pre-shared key mode. If they did, each IoT device (or consumer router, NAS, etc) could ship with a unique key which your browser could prompt for on first use. These could be even be managed by password managers, so you'd get the trust on all your devices. Why isn't this a thing? [0] https://en.wikipedia.org/wiki/TLS-PSK

In the grand scheme of things, IoT devices that don't phone home to a central server just aren't a big enough scenario to drive browser features.
Post reply on HN