Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome’s address bar will use https:// by default

blog.chromium.org

Post reply on HN
Print view View original

401–410 of 463 posts

Re: Chrome’s address bar will use https:// by default

#401

Post by [deleted] »

stefan_ wrote: post #204
tony101 wrote: post #176

Earlier quoted context omitted.

> "I'm all for HTTPS everywhere but right now for my products it's either: https with self-signed certificate, which basically makes any modern browser tell its user that they're in a very imminent danger of violent death should they decide to proceed, or just go with good old HTTP but then you hit all sorts of limitations, and obviously zero security." How about what Plex did for its self-hosted media servers? "Firs…

Yes, why don't we come up with an extremely elaborate scheme to issue more or less faux certificates to these devices that still breaks in practice because it looks like DNS rebinding and requires an internet connection for the device and some VC funded service on the other end in perpetuity for correct operation? Ultimately, the question is why the fuck my browser needs TurkTrust, Saudi CA or others to authenticate…

[deleted]

Re: Chrome’s address bar will use https:// by default

#402

Post by rswail »

reaperducer wrote: post #290
xg15 wrote: post #160

Earlier quoted context omitted.

> All the end user device needs is a connection to the internet once per 90 days. The vast majority of networks have sufficient network connectivity for this. I'm no expert on long-tail use cases, but I'd imagine that most networks either have internet connectivity or they don't. I can't think of many situations where you'd only have internet once every 90 days. Of course one could argue that 90 days long is enough s…

I can't think of many situations where you'd only have internet once every 90 days. Having worked in broadcast news, I can think of hundreds. News doesn't happen in the newsroom. It happens in the field. And very often in places without internet access. Sometimes for weeks or months at a time. (Think siege at Waco, plane crashes, hurricanes, etc.)

If it's broadcast news, then there's some sort of uplink/downlink involved?

Is there no way to have a sideband of that used to broadcast/multicast am X.509 cert over a 90 day period?

Re: Chrome’s address bar will use https:// by default

#403

Post by rswail »

scruple wrote: post #140
londons_explore wrote: post #134

Earlier quoted context omitted.

DNS validation can entirely be done by a server on the internet, which does all the stuff necessary to get the certificate, and then gives the certificate to your end user device. All the end user device needs is a connection to the internet once per 90 days. The vast majority of networks have sufficient network connectivity for this.

I worked in embedded radios for the broadcast industry and SCADA applications for a spell and dealt with the same problems that the GP is describing. Many of these systems are composed of networks built on top of radio modems. It is very common that these devices can't reach the Internet...

They don't have to reach the internet, they need to reach your infrastructure. Your infrastructure needs to reach the internet.

Re: Chrome’s address bar will use https:// by default

#404

Post by rswail »

simias wrote: post #194
londons_explore wrote: post #134

Earlier quoted context omitted.

DNS validation can entirely be done by a server on the internet, which does all the stuff necessary to get the certificate, and then gives the certificate to your end user device. All the end user device needs is a connection to the internet once per 90 days. The vast majority of networks have sufficient network connectivity for this.

I've literally never seen anybody use a domain name to address my devices, only a simple IPv4. That already makes it a nonstarter, but let's entertain the idea. Maybe I can convince my clients to change the way they work, they generally love that. Just going through the trouble of having the customer mess with their OS's DNS resolver to connect to the device is ludicrous. Can you even do it on Windows without having…

There are a couple of possibilities here, given that we're talking costly and critical satellite links.

1. You set up a private PKI using a private CA. AWS will sell you one for $400/month. Install the public root in the trust stores of the clients and then issue 5 year private certs for either IP addresses, or for .local and use DNS-SD.

2. You create a private domain at private.example.com. You get letsencrypt to issue a wildcard for .private.example.com. Then you set up private DNS for that zone. Server cert needs to be updated every 90 days. That involves downloading a single PEM file from your internal network.

Re: Chrome’s address bar will use https:// by default

#405

Post by nilsbunger »

kazen44 wrote: post #268
nilsbunger wrote: post #238

Earlier quoted context omitted.

Seems like a browser could treat the scenario when a user types an IP address differently from a normal domain name resolution (eg even just changing the messaging to be less scary). If you're actually using domain names on your LAN maybe you just have to bite the bullet and sign certificates too. You don't need internet access to have a properly signed certificate.

what about every major network that is not a very small bussiness or home network? Split DNS is used all across to globe to build internal networks.

Could you use an domain that’s internal only and get a wildcard certificate for it ?

Re: Chrome’s address bar will use https:// by default

#406

Post by tsimionescu »

zaarn wrote: post #331
heinrichhartman wrote: post #291

Earlier quoted context omitted.

I have tried to do just that but ran into all kinds of difficulties: 1. Overhead: I have 5 devices that I own 3 of my wife and a smart TV. Setting all this us takes a lot of time, even if it worked fine. 2. What about visitors to my home, that I want to give access? They need the cert as well together with lengthy instructions on how to install it. 3. How do I even install certs on an iPhone? 4. Firefox uses it's own…

If you keep your CA secure, no reason that you can't set the expiration of the root cert to something like 10 years.

Will browsers accept that?

Re: Chrome’s address bar will use https:// by default

#407

Post by netik »

forgotmypw17 wrote: post #241
simias wrote: post #199

Earlier quoted context omitted.

HTTP is effectively considered legacy by the big web actors these days. More and more APIs are HTTPS-only (often for good reasons) and the "insecure" warnings you get from using HTTP become more intrusive every year. The trajectory is pretty clear, the long term plan is to phase out HTTP completely. And I'm not against it, but I need a solution for LAN devices, and it doesn't exist at the moment because the big web a…

I AM against it, because it puts more centralized censorship power in the hands of the certificate authority. Also, it completely cuts out "legacy" devices, basically anything more than 5 years old. The Web is once again splitting into AOLized mainstream and "indie underground" that you have to make an effort to access.

Let’s encrypt exists, your argument is moot.

Re: Chrome’s address bar will use https:// by default

#408

Post by forgotmypw17 »

chc wrote: post #294
forgotmypw17 wrote: post #241

Earlier quoted context omitted.

I AM against it, because it puts more centralized censorship power in the hands of the certificate authority. Also, it completely cuts out "legacy" devices, basically anything more than 5 years old. The Web is once again splitting into AOLized mainstream and "indie underground" that you have to make an effort to access.

Who is "the certificate authority" you're referring to here?

The authority who grants you your SSL certificate. There is more than one out there, sure, but you can't do it without them. And ultimately, they all answer to the same authority above them: the browser maker who populates the root trust store.

So, to summarize: one more way for the browser maker to control what the user can and cannot access without jumping through hoops.

Re: Chrome’s address bar will use https:// by default

#409

Post by midasuni »

isignal wrote: post #346
jussij wrote: post #332

Earlier quoted context omitted.

The OP means that in using https (and being forced to used https) you are also being forced into paying a 'third party' an annual fee just to get a valid certificate. That 'third party' is one of the recognized 'certificate authorities'. But the OPs point is by going https, you don't have a choice, you have to pay the certificate tax.

This is not true, you can set your host to trust a self signed certificate without much difficulty. Check out this tool for example https://github.com/FiloSottile/mkcert (prev discussion at https://news.ycombinator.com/item?id=17748208 )

I would like to trust a given root very for only a specific domain (and sub domain)

I.e *.int.mycorp.com, but not www.mybank.com

Browsers don’t let me do that, it’s either app or nothing. X509 name constraints aren’t great either and don’t give me, the browser operator, the power.

Re: Chrome’s address bar will use https:// by default

#410

Post by durpkingOP »

jVinc wrote: post #168

What a journey it has been. http://www.example.com http://example.com https://example.com example.com We're finally getting there! Now just a decades to go and we'll reverse the order to get com.example After which we'll wait a couple of decades to decide we don't need TLDs as ICANN is instead just given a free pass to print any amount of money they want without that silly distraction. Then we'll be at just: example…

i think it would be com/example
Post reply on HN