From the thread:
"While we're at it, can we add one of those glorious SSL failure screens to any sites that don't use HTTPS in a future version of Chrome?"
"We are working on something like that, but gentler."
YMMV, but: ugh.
Removing SSLv3 in Chrome
11–20 of 36 posts
Re: Removing SSLv3 in Chrome
#12Re: Removing SSLv3 in Chrome
#13From the thread: "While we're at it, can we add one of those glorious SSL failure screens to any sites that don't use HTTPS in a future version of Chrome?" "We are working on something like that, but gentler." YMMV, but: ugh.
It's a Good Thing. For example, when Google announced they'll rank HTTPS sites slightly higher, CloudFlare announced adding SSL support to their free tier soon after, free certificates continue to be available. We should absolutely be pushing forward with secure and encrypted HTTP everywhere and be making it as easy as possible for developers to get on board.
Re: Removing SSLv3 in Chrome
#14Huge props to the Chromium team for doing this; it's an excellent precedent. SSLv3 is broken, and the only reason it's been so well-supported is that the browsers were unwilling to break web servers; the operators of those servers can't be counted on to fix them, and users direct their ire at the browser vendors. But apparently there's a red line across which the browsers won't make up for broken server configuration…
Just to add, Firefox announced two weeks ago that SSLv3 would be disabled by default in Firefox v34[1], around late November. [1] https://blog.mozilla.org/security/2014/10/14/the-poodle-atta...
this is good news--Firefox leaving users vulnerable to well-known attacks by default for just a few months is actually a major improvement (not being sarcastic).
mozilla security engineers have a history of making excuses of the "let's continue doing this incredibly unsafe thing in Firefox in the name of legacy compatibility" variety. i'm thinking of folks like julien vehent & brian smith here, but kudos to the rest of the mozilla security team for finally starting to move beyond the tortured logic of defaults that leave all ff users vulnerable.
Re: Removing SSLv3 in Chrome
#15From the thread: "While we're at it, can we add one of those glorious SSL failure screens to any sites that don't use HTTPS in a future version of Chrome?" "We are working on something like that, but gentler." YMMV, but: ugh.
It's a Good Thing. For example, when Google announced they'll rank HTTPS sites slightly higher, CloudFlare announced adding SSL support to their free tier soon after, free certificates continue to be available. We should absolutely be pushing forward with secure and encrypted HTTP everywhere and be making it as easy as possible for developers to get on board.
> encrypted HTTP everywhere
Do you really think everything, everything deserves encrypted comunication? cat photos too?
Re: Removing SSLv3 in Chrome
#16Earlier quoted context omitted.
It's a Good Thing. For example, when Google announced they'll rank HTTPS sites slightly higher, CloudFlare announced adding SSL support to their free tier soon after, free certificates continue to be available. We should absolutely be pushing forward with secure and encrypted HTTP everywhere and be making it as easy as possible for developers to get on board.
> encrypted HTTP everywhere Do you really think everything, everything deserves encrypted comunication? cat photos too?
i do. why let verizon or at&t inject trackers...even for cat photos?
Re: Removing SSLv3 in Chrome
#17The last update to Iceweasel in Debian stable disabled SSLv3 over a week ago. So far I've only encountered one website I frequent that will need intervention, but otherwise it was hardly noticeable.
Re: Removing SSLv3 in Chrome
#18Huge props to the Chromium team for doing this; it's an excellent precedent. SSLv3 is broken, and the only reason it's been so well-supported is that the browsers were unwilling to break web servers; the operators of those servers can't be counted on to fix them, and users direct their ire at the browser vendors. But apparently there's a red line across which the browsers won't make up for broken server configuration…
Just to add, Firefox announced two weeks ago that SSLv3 would be disabled by default in Firefox v34[1], around late November. [1] https://blog.mozilla.org/security/2014/10/14/the-poodle-atta...
It's been turned off in Nightly for a while, and I've noticed several sites broken because of it - most notably, the T-Mobile payment website.
Re: Removing SSLv3 in Chrome
#19Earlier quoted context omitted.
It's a Good Thing. For example, when Google announced they'll rank HTTPS sites slightly higher, CloudFlare announced adding SSL support to their free tier soon after, free certificates continue to be available. We should absolutely be pushing forward with secure and encrypted HTTP everywhere and be making it as easy as possible for developers to get on board.
> encrypted HTTP everywhere Do you really think everything, everything deserves encrypted comunication? cat photos too?
Yes, absolutely. Controversial content of all sorts (activism, gay rights, sex, etc) gets censored all over the planet and gets people on watchlists.
When you are talking about the potential for controversy itself creating this problem, then yeah, HTTPS becomes a benefit everywhere. "Oh but we just host cute pictures!" - doesn't matter. Maybe someone commented on one of those pictures and said something about China being a terrible country. Maybe an innocent chinese visitor saw that thread and ended up on a watchlist because of that.
And even ignoring the whole "I have nothing to secure" mentality (which is no better than the "I have nothing to hide" mentality, really), having HTTPS everywhere makes the people for whom it matters safer. Look at what happens with Tor.
In a world where encryption is the exception, the one who uses it is immediately labeled a terrorist.
Make no mistake. This is not about "encrypted communications". This is not about asking the user "Do you think what you are doing here warrants extra security?". This is about the medium. It's about making encryption ubiquitous so that these situations never arise.
When you ssh into a machine, do you ask yourself that question? "Oh well I'm just going to do harmless system monitoring, don't need encryption for that!". No, you don't, because the medium gives you that security and you never have to make that false choice.
So what do you gain by not being secure?
The only argument I ever hear in answer to this is "battery life"/"processing power". Such nonsense. Monochrome displays have a similar benefit, but in general computing you don't give users monochrome displays because of all the situations where colors are useful. And you certainly don't ask the user "Do you think this image you are viewing really deserves colors? What do you gain from them, it's practically black & white already!".
I'm so tired of this whole debate. Can you tell? It's such a waste of time. As Poul-Henning Kamp put it last FOSDEM, the NSA loves that debate and probably perpetuates it. "Do we really need encryption for everything?" is a false question, especially on the internet. You don't, but other people might. And just because you have nothing to hide doesn't mean you should show everyone everything. And just because one kid was raped one time in your town doesn't mean you should store your kids in the basement and treat them like emergency supplies.
Re: Removing SSLv3 in Chrome
#20Earlier quoted context omitted.
It's a Good Thing. For example, when Google announced they'll rank HTTPS sites slightly higher, CloudFlare announced adding SSL support to their free tier soon after, free certificates continue to be available. We should absolutely be pushing forward with secure and encrypted HTTP everywhere and be making it as easy as possible for developers to get on board.
> encrypted HTTP everywhere Do you really think everything, everything deserves encrypted comunication? cat photos too?