Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome’s address bar will use https:// by default

blog.chromium.org

Post reply on HN
Print view View original

361–370 of 463 posts

Re: Chrome’s address bar will use https:// by default

#361

Post by xg15 »

zaarn wrote: post #333
xg15 wrote: post #308

Earlier quoted context omitted.

> initial connections to http-only sites will be a bit slower (vs. the opposite which used to be true: initial connections to https-only sites were slower). More than a bit. For HTTPS-only sites, the site could serve a stub HTTP endpoint on port 80 that redirects to HTTPS. The redirect causes maybe some milliseconds to a few seconds (worst case) of latency. HTTP-only on the other hand can't do a HTTPS stub as easily…

You can simply send a ICMP Rejected Message, which should direct your browser to immediately try any fallbacks or other hosts. Timeouts occur when you incorrectly configure your firewall to drop packets instead of rejecting.

True, that would work as well. Though I believe it's recommended as a best practice to simply drop packets as not to help port scanners.

Re: Chrome’s address bar will use https:// by default

#362

Post by CGamesPlay »

birdman3131 wrote: post #29

How does it behave when the site nominally supports https but only uses a self signed cert? Many local network items are like this. in most cases it might be better to fallback to http but I am not sure.

I think what will happen is that visiting `vcap.me` will open `https://vcap.me`, which would fail with a cert error, so Chrome will automatically (without showing the error) open `http://vcap.me`, which would issue a redirect to `https://vcap.me`, which would fail with a cert error.

If you were navigating to `localhost`, Chrome would directly open `http://localhost` which would do the redirect.

It's unclear if Chrome is smart enough to know that `vcap.me` is a localhost service, but we can imagine a remote host which would behave the same way.

Re: Chrome’s address bar will use https:// by default

#363

Post by jimrandomh »

max-ibel wrote: post #125
jimrandomh wrote: post #72

Earlier quoted context omitted.

Huh. I didn't know that setting existed. And I make a habit of systematically going through the settings pages of every app I use (and in Chrome's case, also chrome://flags), to find out about things like this. It looks like that option exists only in the right-click menu, and not in chrome://settings. That's a problem!

You go through every Chrome setting/flag? That's very ... sporty. I mean, I'd like to do this as well, but Chrome has hundreds of settings and flags, so going through them takes serious time (some settings are fairly arcane "Temporarily unexpire M87 flags."). And they can be amended on every update, which might hit you weekly. Hat off to your determination!

I'm certainly not rechecking on every update! More like once at install time, and every few years if it seems like things have changed a lot.

Re: Chrome’s address bar will use https:// by default

#364

Post by comboy »

NickNameNick wrote: post #300
qwertox wrote: post #278

Earlier quoted context omitted.

> It's worrying how they are improving the case for "70%" scenarios, while crippling it for the other 30%, without recourse. It's not even funny any more. I constantly have issues with this address bar hiding the scheme and even the www. One issue is when I quickly want to select some parameters or delete parts of the url in order to "up" one level. What drives me absolutely insane is their inconsitent autocomplete f…

It's a silly hack, but if you install googles "Suspicious site reporter" extension for chrome, then the chrome address bar retains the full URL all the time.

Or you could right click on the address bar and select "Always show full URLs"

Re: Chrome’s address bar will use https:// by default

#365

Post by CGamesPlay »

goodside wrote: post #258

This is a great instance of https://xkcd.com/1172/ for me. "example.com" is the only domain name I intentionally load over HTTP in Chrome, so this change breaks my workflow. Many for-pay wifi networks (e.g. on airplanes) are designed to intercept all HTTP requests from guest users, redirecting the browser to a login/signup page. Until you log in HTTPS is blocked, so you have to try to open a domain Chrome doesn't rec…

You're gonna want to switch to http://neverssl.com, with is designed precisely for this purpose. The new Chrome behavior will not break this site.

Re: Chrome’s address bar will use https:// by default

#366

Post by CGamesPlay »

louis-lau wrote: post #310
goodside wrote: post #258

This is a great instance of https://xkcd.com/1172/ for me. "example.com" is the only domain name I intentionally load over HTTP in Chrome, so this change breaks my workflow. Many for-pay wifi networks (e.g. on airplanes) are designed to intercept all HTTP requests from guest users, redirecting the browser to a login/signup page. Until you log in HTTPS is blocked, so you have to try to open a domain Chrome doesn't rec…

Did you read the blog post? It will now use http if https fails. So http only sites will still work for this.

Hey, take a look over the HN guidelines, specifically this one:

> Please don't comment on whether someone read an article. "Did you even read the article? It mentions that" can be shortened to "The article mentions that."

https://news.ycombinator.com/newsguidelines.html

Re: Chrome’s address bar will use https:// by default

#367

Post by drusepth »

michaelt wrote: post #354
smokey_circles wrote: post #257

Earlier quoted context omitted.

>I wish there was a solution for those of us who develop web interfaces for embedded products designed to live on LAN, often without any internet access and no well defined domain name. Don't use the browser? I understand the temptation to use the browser, but this is the price you pay for using someone else's platform: They're free to close whatever door they want. HTML renderers are dime a dozen. Electron is a thin…

Telling users that, in order to connect their new router to the internet they must first download your native app from the internet... sounds like a non-ideal design?

To be fair, my current ISP (xFinity) and my previous ISP (Google Fi) both technically support some kind of web interface, but both push hard to get you to download their app and use that instead.

I had no problem (in either case) just downloading the app and using it to set up my networks. Most people know how app stores work now.

Re: Chrome’s address bar will use https:// by default

#368

Post by avra »

qwertox wrote: post #278
j1elo wrote: post #136

Earlier quoted context omitted.

It's worrying how they are improving the case for "70%" scenarios, while crippling it for the other 30%, without recourse. It's not even funny any more. What happens with offline LAN? And the ideal IoT devices that we would all want to have? (I mean those we dream about in all IoT HN posts, where the rants typically are that no internet connection should be needed for most of these kinds of devices) What about offlin…

> It's worrying how they are improving the case for "70%" scenarios, while crippling it for the other 30%, without recourse. It's not even funny any more. I constantly have issues with this address bar hiding the scheme and even the www. One issue is when I quickly want to select some parameters or delete parts of the url in order to "up" one level. What drives me absolutely insane is their inconsitent autocomplete f…

In Chrome you can right click the address bar and select "Always show full URLs". I prefer how Firefox highlights the most important part and still shows the full URL.

Re: Chrome’s address bar will use https:// by default

#369

Post by fomine3 »

merb wrote: post #229
oarsinsync wrote: post #210

Earlier quoted context omitted.

> 1. Create your own root Certificate Authority. 2. Ensure that the security around your new root CA is watertight, so that if your environment ever gets compromised, someone can't generate a new *.google.com or *.yourbank.com certificate signed by your CA and then MITM your connection.

3. use cross signing with name constraints to not have this problem https://tools.ietf.org/html/rfc5280#section-4.2.1.10

Issuing CA cert with Name Constraints is good, but end user should recognize the certificate is constrained to their domains or not.

Re: Chrome’s address bar will use https:// by default

#370

Post by nine_k »

simias wrote: post #111

I wish there was a solution for those of us who develop web interfaces for embedded products designed to live on LAN, often without any internet access and no well defined domain name. I'm all for HTTPS everywhere but right now for my products it's either: https with self-signed certificate, which basically makes any modern browser tell its user that they're in a very imminent danger of violent death should they deci…

An ability for a browser to talk https over a Unix socket, or a Windows pipe, would help a lot.

Each can be secured by regular OS means, so a rouge impostor process won't be an issue.

Post reply on HN