Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Blink - Intent to deprecate: Insecure usage of powerful features

groups.google.com

Post reply on HN
Print view View original

21–30 of 96 posts

Re: Blink - Intent to deprecate: Insecure usage of powerful features

#21

Post by anon4 »

icebraining wrote: post #7
jbb555 wrote: post #3

Basically they are destroying the simplicity of the internet in order to push their own agenda. I'd get annoyed about it, but it's not going to be long before it all collapses under it's own weight and something new and lightweight turns up to take over from what http used to be good for.

I don't understand your criticism. They are requiring HTTPS to use complex/advanced features. You're still free to serve your handwritten HTML 4.0 over unencrypted HTTP 1.1. What simplicity is being destroyed here? If anything, they're making it more costly to make complex websites.

One thing I'll definitely miss is being able to look at traffic with wireshark. I've used it to great effect when I had to debug a failing service and wanted to see exactly what the browser was sending that was tripping it.

Re: Blink - Intent to deprecate: Insecure usage of powerful features

#22

Post by ldng »

fpgeek wrote: post #6
jbb555 wrote: post #3

Basically they are destroying the simplicity of the internet in order to push their own agenda. I'd get annoyed about it, but it's not going to be long before it all collapses under it's own weight and something new and lightweight turns up to take over from what http used to be good for.

Did you even look at the kinds of attacks that motivate these restrictions before concluding that there was a nefarious agenda at work? I took a look at a Fullscreen API attack ( http://feross.org/html5-fullscreen-api-attack/ ) and found it pretty creepy even though I knew exactly what to expect and what to look for. Tighter controls over that sort of thing seem like a great idea to me.

Maybe I'm dense but I don't see how requiring HTTPS would solve phishing attacks. To me it falls in the social engineering realm, people clicking link in their mail thay really should not. Having an extra 's' in the URL will not change that. Am I missing the point ?

Re: Blink - Intent to deprecate: Insecure usage of powerful features

#23

Post by shangxiao »

bd wrote: post #20

Uhm, I strongly disagree with making fullscreen https only feature. For WebGL and WebVR community this would be a big step backwards, making browser applications again second class citizen vs native apps. And it's not like there aren't already strong enough protections in place. Try for example visiting this mock attack site: http://feross.org/html5-fullscreen-api-attack/ In every browser I tried it was already obvio…

The point of that article was that people don't notice subtle changes, especially when their not tech savvy/tired after a long day of work/whatever. Also someone pointed out in the comments that some people tend to ignore changes and click on whatever to get to their destination.

Re: Blink - Intent to deprecate: Insecure usage of powerful features

#25

Post by TazeTSchnitzel »

thomasfoster96 wrote: post #2

Once Let's Ecrypt [0] launches, I suppose most web developers won't have any more excuses not to use HTTPS. It'll be free, pretty easy and quick time wise, plus it'll give you an SEO boost. Browser vendors are certainly doing the right thing by making http be marked as non-secure, and not implementing unencrypted http/2 and not allowing non-HTTPS access to powerful api are completely reasonable steps to take. [0] htt…

What about HTTPS for local testing, though?

Re: Blink - Intent to deprecate: Insecure usage of powerful features

#26

Post by philh »

fpgeek wrote: post #6
jbb555 wrote: post #3

Basically they are destroying the simplicity of the internet in order to push their own agenda. I'd get annoyed about it, but it's not going to be long before it all collapses under it's own weight and something new and lightweight turns up to take over from what http used to be good for.

Did you even look at the kinds of attacks that motivate these restrictions before concluding that there was a nefarious agenda at work? I took a look at a Fullscreen API attack ( http://feross.org/html5-fullscreen-api-attack/ ) and found it pretty creepy even though I knew exactly what to expect and what to look for. Tighter controls over that sort of thing seem like a great idea to me.

But that attack works just as well if feross.org uses SSL, doesn't it? I'm not sure what MITM+fullscreen gets an attacker that they don't get from either by itself.

Which isn't to say there's no reason to only allow fullscreen over SSL, but I can't offhand think of one.

Re: Blink - Intent to deprecate: Insecure usage of powerful features

#27

Post by Aldo_MX »

psykovsky wrote: post #8
thomasfoster96 wrote: post #2

Once Let's Ecrypt [0] launches, I suppose most web developers won't have any more excuses not to use HTTPS. It'll be free, pretty easy and quick time wise, plus it'll give you an SEO boost. Browser vendors are certainly doing the right thing by making http be marked as non-secure, and not implementing unencrypted http/2 and not allowing non-HTTPS access to powerful api are completely reasonable steps to take. [0] htt…

If everybody gets an SEO boost, there is no boost. :)

Except that not everybody will do it since day 1

Re: Blink - Intent to deprecate: Insecure usage of powerful features

#28

Post by TazeTSchnitzel »

ldng wrote: post #22
fpgeek wrote: post #6

Earlier quoted context omitted.

Did you even look at the kinds of attacks that motivate these restrictions before concluding that there was a nefarious agenda at work? I took a look at a Fullscreen API attack ( http://feross.org/html5-fullscreen-api-attack/ ) and found it pretty creepy even though I knew exactly what to expect and what to look for. Tighter controls over that sort of thing seem like a great idea to me.

Maybe I'm dense but I don't see how requiring HTTPS would solve phishing attacks. To me it falls in the social engineering realm, people clicking link in their mail thay really should not. Having an extra 's' in the URL will not change that. Am I missing the point ?

1) You need to have been approved by a CA to get a TLS certificate

2) If HTTPS is required, MITMing can't be used to take advantage of permissions you've granted to existing sites

Re: Blink - Intent to deprecate: Insecure usage of powerful features

#29

Post by pjmlp »

bd wrote: post #20

Uhm, I strongly disagree with making fullscreen https only feature. For WebGL and WebVR community this would be a big step backwards, making browser applications again second class citizen vs native apps. And it's not like there aren't already strong enough protections in place. Try for example visiting this mock attack site: http://feross.org/html5-fullscreen-api-attack/ In every browser I tried it was already obvio…

> For WebGL and WebVR community this would be a big step backwards, making browser applications again second class citizen vs native apps.

They still are. Most of the time someone posts a WebGL demo here, they fail to run on my devices that have no issue with OpenGL ES 3.0 for native applications.

Re: Blink - Intent to deprecate: Insecure usage of powerful features

#30

Post by JustGotHere »

anon4 wrote: post #21
icebraining wrote: post #7

Earlier quoted context omitted.

I don't understand your criticism. They are requiring HTTPS to use complex/advanced features. You're still free to serve your handwritten HTML 4.0 over unencrypted HTTP 1.1. What simplicity is being destroyed here? If anything, they're making it more costly to make complex websites.

One thing I'll definitely miss is being able to look at traffic with wireshark. I've used it to great effect when I had to debug a failing service and wanted to see exactly what the browser was sending that was tripping it.

Is it not posible to grab the binary stream and decode it, just like the browser would, on the fly with wireshark?
Post reply on HN