Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome’s address bar will use https:// by default

blog.chromium.org

Post reply on HN
Print view View original

421–430 of 463 posts

Re: Chrome’s address bar will use https:// by default

#421

Post by katbyte »

midasuni wrote: post #412
katbyte wrote: post #390

Earlier quoted context omitted.

15$ a year for a domain, throw traffic through local [split?] dns and traefik with the lets encrypt dns challenge and call it a day? i have over 25 internal domains & services with 25 certs auto renewing and no one can tell - it just works and is easier the self signing certs and loading them into whatever rando service or device your trying to secure

Split dns is dying - doh is sorting that. Sure canary domains exist, but they won’t forever

i'm not sure i follow, what does split DNS have to do with DoH? i don't want my internal DNS addresses public, there is no need + security and for some addresses i have different IPs internal vs external.

Re: Chrome’s address bar will use https:// by default

#422

Post by dcow »

cookiengineer wrote: post #394
simias wrote: post #111

I wish there was a solution for those of us who develop web interfaces for embedded products designed to live on LAN, often without any internet access and no well defined domain name. I'm all for HTTPS everywhere but right now for my products it's either: https with self-signed certificate, which basically makes any modern browser tell its user that they're in a very imminent danger of violent death should they deci…

A hypothetical solution would be to stick with the DNS SD / avahi concept and use domains ending in .local. That would have the benefit to be able to create a CA for that domain that can cross-sign your certificates in order to prevent the snakeoil workflow, which must stick to local IPv4 ranges and the fe80:: IPv6 prefix. I've been digging through the DNS SD specifications lately (and how airplay, airprint, airscan…

> I've been digging through the DNS SD specifications lately (and how airplay, airprint, airscan and others work)...and I'm mindblown on how simple all things IoT could be if everything would support the DNS service discovery RFC.

It's amazing when you see it all, isn't it? IMO the slow process is communicating to product owners and IPv4-locked technical architects about how these things are actually supposed to work.

Re: Chrome’s address bar will use https:// by default

#423

Post by nec4b »

netik wrote: post #407
forgotmypw17 wrote: post #241

Earlier quoted context omitted.

I AM against it, because it puts more centralized censorship power in the hands of the certificate authority. Also, it completely cuts out "legacy" devices, basically anything more than 5 years old. The Web is once again splitting into AOLized mainstream and "indie underground" that you have to make an effort to access.

Let’s encrypt exists, your argument is moot.

Can you use it on a microcontroller in a home network?

Re: Chrome’s address bar will use https:// by default

#424

Post by tialaramex »

fluidcruft wrote: post #249
ohyeshedid wrote: post #185

Earlier quoted context omitted.

I'm wondering if the tested Firefox install has enabled DoH?

Oh interesting. Firefox says it's both enabled and set to use 1.1.1.1, and I figured that nothing would resolve if it wasn't... but if https://1.1.1.1/help is correct then it's not actually working and something else is happening. I know I tried setting and disabling that when I was testing but I saw no change. I don't remember setting 1.1.1.1 but I may have enabled DoH. I'll see if changing the DNS server in firefox…

> Not really sure what the point of DoH is if networks can just silently override the setting.

You can explicitly configure the browser to insist on DoH whereupon it's your fault if that doesn't work. But the defaults changed only to try to do DoH if they can.

"If a user has chosen to manually enable DoH, the signal from the network will be ignored and the user’s preference will be honored."

Re: Chrome’s address bar will use https:// by default

#425

Post by cblconfederate »

SV_BubbleTime wrote: post #329
cblconfederate wrote: post #190

Earlier quoted context omitted.

Actually we should have switched to resource locators that are just plain strings ("ycombinator news threads 26558305" . It s what google has been pushing everyone to do anyway (readable URLs), and what the centralization of the web led to ( fb / twitter usernames). Its easy for people to parse and speak through the phone, and it would be a decentralized, natural revival of AOL keywords. It would also drop total goog…

> Not sure where the protocol would fit though A thousand twitchy heads just popped up, eyes narrowed then widened... a new protocol you say?!

no just a new URL. closer to how most people use the address bar

Re: Chrome’s address bar will use https:// by default

#426

Post by josefx »

prepend wrote: post #396
josefx wrote: post #153

Earlier quoted context omitted.

You mean like by someone throwing up a huge warning that this page is made by the devil himself and unless he recites the right combination of holy words there is nothing you can do to access it? Ran into a few pages that were hijacked that way, some of them at least seemed to go to the expected content when I got rid of the https.

There’s certainly risk, but I don’t think converting all traffic to ssl is worth it to mitigate the risk. I’ve never run into this situation in many years.

My comment was actually meant to be sarcastic and a bit over the top. The hijacker in this case would be the browser telling me that the page is not secure and as far as I remember valid certs are enforced to the point where a user can't bypass the error in some cases. In my experience https has always been more of a hurdle when I was looking for some obscure information hidden away on barely maintained websites.

Re: Chrome’s address bar will use https:// by default

#427

Post by midasuni »

grahamburger wrote: post #418
midasuni wrote: post #413

Earlier quoted context omitted.

If you’re the network operator you can mitm network traffic if curse. If you aren’t how are you running a dhcp server when the switch will block the packets?

Switches don't typically block DHCP packets. You can literally just spin up your own DHCP server and plug it in to a switch port - if your fake server responds to a DHCP request faster than the legit DHCP server the client will get your lease instead of the right one. It's this way by design - it's not at all uncommon for the DHCP server to not run on the router itself, but on some other device elsewhere in the netwo…

Depends on who configures them, but normally you’d have dhcp snooping on your switch

Re: Chrome’s address bar will use https:// by default

#428

Post by midasuni »

katbyte wrote: post #421
midasuni wrote: post #412

Earlier quoted context omitted.

Split dns is dying - doh is sorting that. Sure canary domains exist, but they won’t forever

i'm not sure i follow, what does split DNS have to do with DoH? i don't want my internal DNS addresses public, there is no need + security and for some addresses i have different IPs internal vs external.

Browsers send to external provider like google, rather than the network provided server which has the internal addresses (and which may override external addresses for various reasons)

Re: Chrome’s address bar will use https:// by default

#429

Post by midasuni »

cblconfederate wrote: post #425
SV_BubbleTime wrote: post #329

Earlier quoted context omitted.

> Not sure where the protocol would fit though A thousand twitchy heads just popped up, eyes narrowed then widened... a new protocol you say?!

no just a new URL. closer to how most people use the address bar

rfc1738 Defines urls, feel free to propose another one for whatever scheme you want.

I for one am quite happy with urls and use them all the time. If I want to search I will use the separate search box.

Re: Chrome’s address bar will use https:// by default

#430

Post by midasuni »

kstrauser wrote: post #327
jiehong wrote: post #323

Earlier quoted context omitted.

Yep, that’s called the FQDN (with a leading dot, so it’s .com.example)

An FQDN doesn't imply it's reversed: https://en.wikipedia.org/wiki/Fully_qualified_domain_name I've never seen an FQDN written that way. It may be possible, but it definitely isn't common.

Java’s package names tend to follow the com.domain.subdomain.etc pattern

Not seen them elsewhere.

Post reply on HN