Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome’s address bar will use https:// by default

blog.chromium.org

Post reply on HN
Print view View original

371–380 of 463 posts

Re: Chrome’s address bar will use https:// by default

#371

Post by fomine3 »

j1elo wrote: post #136
simias wrote: post #111

I wish there was a solution for those of us who develop web interfaces for embedded products designed to live on LAN, often without any internet access and no well defined domain name. I'm all for HTTPS everywhere but right now for my products it's either: https with self-signed certificate, which basically makes any modern browser tell its user that they're in a very imminent danger of violent death should they deci…

It's worrying how they are improving the case for "70%" scenarios, while crippling it for the other 30%, without recourse. It's not even funny any more. What happens with offline LAN? And the ideal IoT devices that we would all want to have? (I mean those we dream about in all IoT HN posts, where the rants typically are that no internet connection should be needed for most of these kinds of devices) What about offlin…

OpenWRT's story

https://lwn.net/Articles/837491/

Re: Chrome’s address bar will use https:// by default

#372

Post by achew22 »

tim-- wrote: post #357
upofadown wrote: post #314

Earlier quoted context omitted.

Why would the certs you create for this purpose be made to expire?

It needs to expire before 397 days, because otherwise the CA will not be valid, even if it is marked as trusted. https://www.zdnet.com/article/google-wants-to-reduce-lifespa... edit: a word

The article you linked to is kind of confused and I'm not sure I blame them. This stuff is really complex!

According to the proposal[0], leaf certificates are prohibited from being signed with a validity window of more than 397 days by a CA/B[1] compliant Certificate authority. This is very VERY different from the cert not being valid. It means that a CA could absolutely make you a certificate that violated these rules. If a CA signed a certificate with a longer window, they would risk having their root CA removed from the CA/B trust store which would make their root certificate pretty much worthless.

To validate this, you can look at the CA certificates that Google has[2] that are set to expire in 2036 (scroll down to "Download CA certificates" and expand the "Root CAs" section) several of which have been issued since that CA/B governance change.

As of right now, as far as I know, Chrome will continue to trust certificates that are signed with a larger window. I've not heard anything about browsers enforcing validity windows or anything like that, but would be delighted to find out the ways that I'm wrong if you can point me to a link.

Further, your home made root certificate will almost certainly not be accepted by CA/B into their trust store (and it sounds like you wouldn't want that) which means you're not bound by their governance. Feel free to issue yourself a certificate that lasts 1000 years and certifies that you're made out of marshmallows or whatever you want. As long as you install the public part of the CA into your devices it'll work great and your phone/laptop/whatever will be 100% sure you're made out of puffed sugar.

I guess I have to disclose that I'm an xoogler who worked on certificate issuance infrastructure and that this is my opinion, that my opinons are bad and I should feel bad :zoidberg:.

[0] https://github.com/cabforum/servercert/pull/138/commits/2b06... [1] https://en.wikipedia.org/wiki/CA/Browser_Forum [2] https://pki.goog/repository/

Re: Chrome’s address bar will use https:// by default

#373

Post by stormbrew »

kccqzy wrote: post #267
simias wrote: post #111

I wish there was a solution for those of us who develop web interfaces for embedded products designed to live on LAN, often without any internet access and no well defined domain name. I'm all for HTTPS everywhere but right now for my products it's either: https with self-signed certificate, which basically makes any modern browser tell its user that they're in a very imminent danger of violent death should they deci…

The article says > IP addresses, single label domains, and reserved hostnames such as test/ or localhost/ will continue defaulting to HTTP. I don't think this affects you. If you are accessing a device on your LAN, you either use its IP address, or if you use DNS, you must be using your own DNS resolver then. In that case you can just use a single-label domain name such as http://media/ and you can omit the " http://…

You could be using mDNS (bonjour), in which case local addresses look like 'whatever.local'. This is actually pretty common?

Honestly if they just made it so self-signed worked for .local that would probably help a lot.

Re: Chrome’s address bar will use https:// by default

#375

Post by [deleted] »

OskarS wrote: post #253
0x0 wrote: post #89

Earlier quoted context omitted.

It's quite annoying when the https:// prefix is hidden but then appears in copy-paste. Quite often I'd like to run things like "host -t mx " or "whois " and then it also copies the invisible " https:// " prefix which is incorrect for these use cases.

https://xkcd.com/1172/

[deleted]

Re: Chrome’s address bar will use https:// by default

#376

Post by est31 »

remram wrote: post #167
est31 wrote: post #94

Earlier quoted context omitted.

The info "is https available" is not secured either. The ISP can just block any packet on port 443 and force http that way. It would break links but wouldn't break people entering the address via the URL bar. A real improvement in security would be Google caching the data, and either offering it via a custom API or just signing it and appending it to their 8.8.8.8 DNS responses. Per default, Chrome already sends the…

Right, as long as it falls back to HTTP, you don't really increase security. And if you have a side-channel like preloaded HSTS lists the change does not apply. So you're right, it just makes HTTPS sites load faster.

Hmm so I thought about it a little and I think the old way allows passive monitoring of the URL within the website while the new way requires active attacks to enable this.

Re: Chrome’s address bar will use https:// by default

#377

Post by dan-robertson »

Wowfunhappy wrote: post #339
dan-robertson wrote: post #303

Earlier quoted context omitted.

But the number matters to your point. Focusing on 70% of users to the detriment of 30% seems a lot less defensible than focusing on 99.9% of users to the detriment of 0.1%. The claim you made was “chrome is hurting a large minority of users and they should make a browser in a more fair way” but this changes when you change your made up numbers to something more like “chrome is hurting a tiny minority of users with we…

> Focusing on 70% of users to the detriment of 30% seems a lot less defensible than focusing on 99.9% of users to the detriment of 0.1%. Ah, but now you’re measuring a different thing than the GP, users vs scenarios! I’d hazard a guess that at least 30% of users need to log into a router at some point or another. I hope it’s more than 30%, because everyone else is likely paying ridiculous prices for a crappy router f…

The change doesn’t affect routers (which I think most people don’t know how to log into these days) as there is no https default for URIs outside of the scope of normal PKI (ip addresses and single-level names). Are we disagreeing about the actual change or an imagined future one?

Re: Chrome’s address bar will use https:// by default

#378

Post by Sebb767 »

merb wrote: post #229
oarsinsync wrote: post #210

Earlier quoted context omitted.

> 1. Create your own root Certificate Authority. 2. Ensure that the security around your new root CA is watertight, so that if your environment ever gets compromised, someone can't generate a new *.google.com or *.yourbank.com certificate signed by your CA and then MITM your connection.

3. use cross signing with name constraints to not have this problem https://tools.ietf.org/html/rfc5280#section-4.2.1.10

4. Find out that name constraints are either not supported or ignore by basically all major libraries.

Re: Chrome’s address bar will use https:// by default

#379

Post by greggman3 »

heinrichhartman wrote: post #291
chpatrick wrote: post #259

Earlier quoted context omitted.

You can set up the users' machines so that they trust your certificate.

I have tried to do just that but ran into all kinds of difficulties: 1. Overhead: I have 5 devices that I own 3 of my wife and a smart TV. Setting all this us takes a lot of time, even if it worked fine. 2. What about visitors to my home, that I want to give access? They need the cert as well together with lengthy instructions on how to install it. 3. How do I even install certs on an iPhone? 4. Firefox uses it's own…

I am as upset as you about this and cancelled IoT related projects because of it

But, #3 How do I even install certs on an iPhone

AFAIK (though I've never done it) you use a configuration profile

https://developer.apple.com/documentation/devicemanagement/c...

https://support.apple.com/guide/deployment-reference-ios/cer...

Re: Chrome’s address bar will use https:// by default

#380

Post by p1mrx »

OskarS wrote: post #253
0x0 wrote: post #89

Earlier quoted context omitted.

It's quite annoying when the https:// prefix is hidden but then appears in copy-paste. Quite often I'd like to run things like "host -t mx " or "whois " and then it also copies the invisible " https:// " prefix which is incorrect for these use cases.

https://xkcd.com/1172/

How is copying a hostname from the address bar an unreasonable workflow? How would you whois the site you're viewing?
Post reply on HN