Chrome is a jerk
Chrome will mark all HTTP sites as ‘not secure’ starting in July
111–120 of 143 posts
Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July
#112Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July
#113Earlier quoted context omitted.
I bought a Uniquiti AMPLIFI home router. It’s great for signal, but can only be administered through their app (all traffic through their cloud, etc). This really sucks and they don’t really care as it’s probably easier to dev and they get all that sweet usage data. It’s not a good trend, but this is a plus for most consumers who don’t care about local network security.
Amplifi should be manageable through UNMS by the end of the year or so. I cant seem to find the chart, but here is an image from the forums: https://usercontent-community.amplifi.com/461f0130-9835-459b...
That will be good. I almost bought their enterprise stuff because their signal is so good.
Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July
#114Earlier quoted context omitted.
Name constraints are not universally supported in browsers sadly.
And this should be fixed. Name constraints would be incredibly useful for a number of things, if only they were supported.
I believe Apple is the holdout in this case, meaning Safari and Chrome on MacOS don't support it.
Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July
#115All traffic encrypted means no one can see your outbound transmission data, including you! No way to verify what you're sending on the wire if the application is proprietary (and statically compiled) without dumping memory, which would be quite odious.
...
You own the client. You can watch the traffic in the browser before it is encrypted.
Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July
#116Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July
#117Earlier quoted context omitted.
doesn't that just push the "authority" to DNS. You still need someone to vouch that you are who you say you are.
If a hostile controls a DNS server, you are hosed anyway.
If the sites you care about are using HSTS (and they're in the HSTS preload list, or you've visited them before from this device), then the worst the attacker can do is deny you from accessing them.
Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July
#118Technical people should not be pushing centralization and vested interests, that's not a technical solution. In the a world of state surveillance and invasive data practices by SV based companies it's a difficult to understand this obsession with http scaremongering by some to perpetuate more centralization.
>it's a difficult to understand this obsession with http scaremongering
Your surely meant it's not difficult, right? The first part of your sentence is exactly the answer.
Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July
#119HTTPS is definitely good but this is a bit strong handed.
Many small devs don't want to deal with the complexity of HTTPS and the extra fees. It's a lot better with Let's Encrypt but I've talked to non technical people who have shelled out $300/year to their host providers just to have HTTPS and inevitably lots of things break due to hard coded links in their outdated software.
If authentication happens through a 3rd party provider and the there isn't any need for a site to be secure, why force the matter?
Broken sites lead to a massive drop in sales. All because Google thinks it knows best.
If they truly wanted to solve the problem, why don't they offer a proxy, that converts HTTP traffic to HTTPS traffic that gets used in Chrome.
Instead they force people who don't have the technical knowledge that they can get HTTPS for free to pay huge fees and inevitably have their sites broken in the process.
Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July
#120Is this also true for localhost, or does localhost get special treatment? What is a good way to get https certificates for localhost other than self signed certificates?
https://github.com/FiloSottile/mkcert Still self-signed, but generates a CA that gets added to your browser. It is all pretty seamless.
Is there any downside to using this to secure local servers with non TLD domains such as server.local?