Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome 56 will mark HTTP pages with password fields as non-secure

security.googleblog.com

Post reply on HN
Print view View original

121–130 of 419 posts

Re: Chrome 56 will mark HTTP pages with password fields as non-secure

#121

Post by nathanaldensr »

johndoe4589 wrote: post #95
lucideer wrote: post #4

Firefox has started to do this recently and it's been fantastically informative and helpful. It's the one new browser feature I never really considered wanting/needing before, that's really stood out to me as being incredibly valuable since I've started to see the warnings pop up.

Kinda like how your antivirus tells you about how the formidable threats it saved your ass from today? Or like "did you know your house COULD have been ransacked today, but it didn't happen!!" Now all my users are going to hear that my site is insecure, when nothing at all changed. How long ago did they announce that? I think just a couple months? They should have announced this much sooner. It's going to hit me hard…

Your site's server is just one node in the chain of nodes between your server and the browser. Any one of these nodes could be malicious and tamper with the data in either direction. In other words, this isn't about just your node, it's about all nodes.

Re: Chrome 56 will mark HTTP pages with password fields as non-secure

#122

Post by jessaustin »

Piskvorrr wrote: post #91
tyingq wrote: post #75

Earlier quoted context omitted.

I suspect PCI is okay with it so long as it is an unsecure page that posts to a secure one. Not that it's a great idea, but it would be encrypted in transit. Edit: It appears PCI DSS V3.2 does ask that the form itself be on a secure page (section 4.1.g): "for browser-based implementations: 'HTTPS' appears as the browser Universal Record Locator (URL) protocol, and Cardholder data is only requested if “HTTPS” appears…

Yeah, because MITMing the origin page to submit to evil.example.org is trivial.

In such a case one would expect the evil page to present something that looked like a credit card input to the user, but not to the browser. Sites would still want to use HSTS to combat the MITMing itself.

Re: Chrome 56 will mark HTTP pages with password fields as non-secure

#123

Post by johndoe4589 »

the_duke wrote: post #99
johndoe4589 wrote: post #88

Earlier quoted context omitted.

Their IT guy?? There are gazillions of people like me who have a blog, or some small project that has a small audience of tens to just a few thousand users. All these people now have to fork for SSL, or have to move everything to a different shared hosting that supports Let's Encrypt.

Right now, you can just put Cloudfront in between. It's free, and takes maybe 5 minutes to sign up and adjust your DNS entries. Of course relying on a provider that might cancel the free plan at any time is not ideal, but worst case you just have to revert your DNS and it's done.

I'm running a web app, isn't Cloudflare best for static / semi static content?

Re: Chrome 56 will mark HTTP pages with password fields as non-secure

#124

Post by angry-hacker »

michaelmior wrote: post #98
johndoe4589 wrote: post #95

Earlier quoted context omitted.

Kinda like how your antivirus tells you about how the formidable threats it saved your ass from today? Or like "did you know your house COULD have been ransacked today, but it didn't happen!!" Now all my users are going to hear that my site is insecure, when nothing at all changed. How long ago did they announce that? I think just a couple months? They should have announced this much sooner. It's going to hit me hard…

It may not be an option for you, but you could consider using a free proxy service such as Cloudflare.

Which is not really a true https, depends on your view, but the flexible plan is not encrypted to the source server as one might expect. But if it's possible to set up things that way, it is https, i guess.

Re: Chrome 56 will mark HTTP pages with password fields as non-secure

#125

Post by bsuh »

michaelmior wrote: post #98
johndoe4589 wrote: post #95

Earlier quoted context omitted.

Kinda like how your antivirus tells you about how the formidable threats it saved your ass from today? Or like "did you know your house COULD have been ransacked today, but it didn't happen!!" Now all my users are going to hear that my site is insecure, when nothing at all changed. How long ago did they announce that? I think just a couple months? They should have announced this much sooner. It's going to hit me hard…

It may not be an option for you, but you could consider using a free proxy service such as Cloudflare.

With the caveat that while the password will be encrypted from the browser to Cloudflare, it will still be transmitted as plain text from Cloudflare to your own server if your server doesn't support HTTPS.

So it's an improvement but not entirely a fix.

Re: Chrome 56 will mark HTTP pages with password fields as non-secure

#126

Post by johndoe4589 »

caconym_ wrote: post #106
johndoe4589 wrote: post #95

Earlier quoted context omitted.

Kinda like how your antivirus tells you about how the formidable threats it saved your ass from today? Or like "did you know your house COULD have been ransacked today, but it didn't happen!!" Now all my users are going to hear that my site is insecure, when nothing at all changed. How long ago did they announce that? I think just a couple months? They should have announced this much sooner. It's going to hit me hard…

I am not a security expert, but as I understand it, passwords sent in the clear are vulnerable to being intercepted. Even if users of your site don't have much to worry about from those accounts being compromised (this may or may not be true), lots of people use the same password for more than one login, so their accounts on other sites could be compromised too. That's definitely a significant security risk, even if…

I know I guess I just have to vent some frustration.

Time to move on I guess.

Does anyone have good hosting suggestions for a web app that has a 1GB database and a few thousand active users?

I can only afford ~10-20 EUR a month on shared hosting atm.

Re: Chrome 56 will mark HTTP pages with password fields as non-secure

#127

Post by barnacs »

bsimpson wrote: post #5
foota wrote: post #3

Pm - "why is this page insecure" Developer - "chrome labels password fields as insecure over http" Pm - "what if it wasn't a password field"

Don't you need to use type = "password" to get the -for-every-character treatment? I suppose you could implement your own (e.g. type = "text" with an onKeyDown listener that cached each keystroke and inserted a into the field), but that sounds like a terrible solution in so many ways. I would think the laziest possible way to workaround this would be to use a CDN like Cloudflare to proxy all traffic to your site. Loo…

> I would think the laziest possible way to workaround this would be to use a CDN like Cloudflare to proxy all traffic to your site.

Interesting. Where are all these warnings when a CDN man in the middle attacks your connection? Or when google gets to access all the email communication of gmail users? Or when ad networks track you all around the web?

Re: Chrome 56 will mark HTTP pages with password fields as non-secure

#128

Post by djs070 »

bsimpson wrote: post #5
foota wrote: post #3

Pm - "why is this page insecure" Developer - "chrome labels password fields as insecure over http" Pm - "what if it wasn't a password field"

Don't you need to use type = "password" to get the -for-every-character treatment? I suppose you could implement your own (e.g. type = "text" with an onKeyDown listener that cached each keystroke and inserted a into the field), but that sounds like a terrible solution in so many ways. I would think the laziest possible way to workaround this would be to use a CDN like Cloudflare to proxy all traffic to your site. Loo…

IIRC, type=password also prevents copying saved input to clipboard

Re: Chrome 56 will mark HTTP pages with password fields as non-secure

#129

Post by clamprecht »

dbbk wrote: post #118
clamprecht wrote: post #111

What if the submits to an https page but the page is served up on an http page? The form submission will be secure, correct? Will Chrome still mark as insecure?

The form submission is only half the issue. If the http page gets compromised the malicious party could simply read the contents of the password input.

thanks

Re: Chrome 56 will mark HTTP pages with password fields as non-secure

#130

Post by angry-hacker »

vortico wrote: post #19
myf01d wrote: post #7

Advancing HTTPS is one of a few good things Google made in the recent years. Thanks Google.

It's one of the few things they do that I can't find a reason they would be financially motivated to do so, other than increase developers' opinions about the company as a whole, which is a good thing for all.

I can think few.. Adware substituting their adsense ads for theirs, also isps messing with ads etc.
Post reply on HN