Chrome 56 will mark HTTP pages with password fields as non-secure
security.googleblog.com
Chrome 56 will mark HTTP pages with password fields as non-secure
1–10 of 419 posts
Re: Chrome 56 will mark HTTP pages with password fields as non-secure
#2I know the article is older, but it's January 2017, just a reminde.
The message will appear in the address bar.
Re: Chrome 56 will mark HTTP pages with password fields as non-secure
#3Pm - "why is this page insecure"
Developer - "chrome labels password fields as insecure over http"
Pm - "what if it wasn't a password field"
Re: Chrome 56 will mark HTTP pages with password fields as non-secure
#4Firefox has started to do this recently and it's been fantastically informative and helpful.
It's the one new browser feature I never really considered wanting/needing before, that's really stood out to me as being incredibly valuable since I've started to see the warnings pop up.
Re: Chrome 56 will mark HTTP pages with password fields as non-secure
#5Pm - "why is this page insecure" Developer - "chrome labels password fields as insecure over http" Pm - "what if it wasn't a password field"
Don't you need to use type = "password" to get the -for-every-character treatment?
I suppose you could implement your own (e.g. type = "text" with an onKeyDown listener that cached each keystroke and inserted a into the field), but that sounds like a terrible solution in so many ways.
I would think the laziest possible way to workaround this would be to use a CDN like Cloudflare to proxy all traffic to your site. Looks like they have a service called Flexible SSL that terminates HTTPS at the CDN, and sends unencrypted traffic to your backend:
Re: Chrome 56 will mark HTTP pages with password fields as non-secure
#6Pm - "why is this page insecure" Developer - "chrome labels password fields as insecure over http" Pm - "what if it wasn't a password field"
Developer - "any could see the password..."
Pm - "put one of them modal over it"
Developer - "but then how will anyone..."
Pm - "we're switching to "
Re: Chrome 56 will mark HTTP pages with password fields as non-secure
#7Advancing HTTPS is one of a few good things Google made in the recent years. Thanks Google.
Re: Chrome 56 will mark HTTP pages with password fields as non-secure
#8Pm - "why is this page insecure" Developer - "chrome labels password fields as insecure over http" Pm - "what if it wasn't a password field"
Yay, plaintext input fields for passwords.
/me opens a sake bottle.
Re: Chrome 56 will mark HTTP pages with password fields as non-secure
#9Firefox has a similar feature enabled in dev edition: https://blog.mozilla.org/security/2017/01/20/communicating-t...
Re: Chrome 56 will mark HTTP pages with password fields as non-secure
#10Pm - "why is this page insecure" Developer - "chrome labels password fields as insecure over http" Pm - "what if it wasn't a password field"
Don't you need to use type = "password" to get the -for-every-character treatment? I suppose you could implement your own (e.g. type = "text" with an onKeyDown listener that cached each keystroke and inserted a into the field), but that sounds like a terrible solution in so many ways. I would think the laziest possible way to workaround this would be to use a CDN like Cloudflare to proxy all traffic to your site. Loo…
That's literally what my router's login page does. It is a text box but has JavaScript which converts each non-* character into a * character and stores the actual value in a JS variable.
Why? They added a "Show Password" radio and I guess they figured this hack made more sense than simply using JS to update the DOM to turn it from a type password to a type text.