Camera and microphone require HTTPS in Firefox 68 • Hacker News Board

Re: Camera and microphone require HTTPS in Firefox 68

#131

Post by acdha » Wed, Jul 10, 2019, 1:43 AM UTC

mort96 wrote: post #118

comex wrote: post #111

Earlier quoted context omitted.

If you own a domain, you can add a subdomain that points to the local network IP, and get Let's Encrypt to give you a certificate using the dns-01 validation method (which doesn't require Let's Encrypt to actually access the IP address in the A record). This is clearly more complicated than ideal, but it should work. Edit: You can also use a custom CA root certificate, which can be installed on iOS etc. mkcert is a g…

> This is clearly more complicated than ideal, but it should work. Exactly. Imagine you're someone who just wants to play around with cool web technologies. Maybe you're fairly new to web dev; maybe you're fairly new to the world of programming in general and you're using the web to learn it, which has historically been one of the huge strengths of the web. You suddenly encounter a brick wall, where you figure out th…

This feels pessimistic to me: most people didn’t learn the web that way, instead using shared servers — and there were plenty of similar complaints that it was too hard to learn Unix/Windows admin stuff, too. Today, you can use glitch, github pages, jsbin & a million friends, zeit, etc. or the same cheap Dreamhost account people used $20 years ago and start practicing with HTTPS and many other amenities at minimal cost. JavaScript CDNs make it pretty easy to use a ton of stuff without even needing to learn how to install it, too, and increasingly you can do that as native modules.

I’d worry a lot more about how many people are being told they need a J2EE-scale tool chain to run hello world even though the native environment has never been richer.

Re: Camera and microphone require HTTPS in Firefox 68

#132

Post by peterlk » Wed, Jul 10, 2019, 1:45 AM UTC

petters wrote: post #2

It will still work on localhost, which is nice. It would be nice if it also worked on local IPs, like 192.168. . . Those do not work on Chrome, I think, which make mobile testing a bit more cumbersome.

To any browser developers out there, I beg you, please, please, please whitelist lvh.me. I am so tired of security restrictions making everything painful for lvh.me.

Re: Camera and microphone require HTTPS in Firefox 68

#133

Post by Wowfunhappy » Wed, Jul 10, 2019, 1:48 AM UTC

kgwxd wrote: post #113

Wowfunhappy wrote: post #38

Earlier quoted context omitted.

This is a better solution overall, as it's "by default". A hardware switch relies on the user to be privacy conscious. An LED which is physically connected to the camera circuit (!) is immediately noticeable if it turns on unexpectedly.

This is not a better solution overall and there's no reason we can't have both, other than manufacturer design choices. How often are you looking directly at your camera? Even if you are, once the camera comes on unexpectedly, it's too late.

> How often are you looking directly at your camera?

On my Mac, I find the LED very noticeable when it comes on unexpectedly! It's bright and green and not part of my screen. And yes, this has actually happened to me!

> Even if you are, once the camera comes on unexpectedly, it's too late.

Nah, they saw a few frames—they're very unlikely to be useful. What's more important is knowledge.

I agree we could have both, but each of these features does have a financial cost. I consider the LED significantly more important.

Re: Camera and microphone require HTTPS in Firefox 68

#134

Post by Mister_Snuggles » Wed, Jul 10, 2019, 1:49 AM UTC

comex wrote: post #111

mort96 wrote: post #93

Earlier quoted context omitted.

But how do you do local development when you can't get an SSL cert for your dev machine's server? No, self signed certs don't always do what you need, especially on mobile where you can't just add your cert as a trusted cert easily.

If you own a domain, you can add a subdomain that points to the local network IP, and get Let's Encrypt to give you a certificate using the dns-01 validation method (which doesn't require Let's Encrypt to actually access the IP address in the A record). This is clearly more complicated than ideal, but it should work. Edit: You can also use a custom CA root certificate, which can be installed on iOS etc. mkcert is a g…

Another option is xca[0]. It's not as quick to get going as mkcert, but it's quite full featured. I used it to create an internal CA and certificates for my internal services and it works quite well.

[0] https://hohnstaedt.de/xca/

Re: Camera and microphone require HTTPS in Firefox 68

#135

Post by Wowfunhappy » Wed, Jul 10, 2019, 1:50 AM UTC

mort96 wrote: post #130

Wowfunhappy wrote: post #127

Earlier quoted context omitted.

iOS Chrome is just Safari with a Google skin, Google has no control over this type of thing.

That's both true and completely irrelevant.

Well, it's relevant insofar as you're complaining to the wrong company.

Does this behavior even exists in iOS Chrome? If it does, it exists in Mobile Safari as well.

Re: Camera and microphone require HTTPS in Firefox 68

#136

Post by tty2300 » Wed, Jul 10, 2019, 1:50 AM UTC

peterlk wrote: post #132

petters wrote: post #2

It will still work on localhost, which is nice. It would be nice if it also worked on local IPs, like 192.168. . . Those do not work on Chrome, I think, which make mobile testing a bit more cumbersome.

To any browser developers out there, I beg you, please, please, please whitelist lvh.me. I am so tired of security restrictions making everything painful for lvh.me.

Why? That is just an ordinary domain name that someone pointed at local host. I don't see why it should get any security exemptions.

Re: Camera and microphone require HTTPS in Firefox 68

#137

Post by tenebrisalietum » Wed, Jul 10, 2019, 1:54 AM UTC

marknadal wrote: post #112

This sucks, my community[1] has a local offline-first video/audio call app that we run on a physical mesh network. This will make it impossible for people to talk to each other, without first needing to be connected online to some certificate authority, or without some extraordinarily difficult pre-installation process, which is often not even possible on a phone. HTTPS was important, but now its being used to shoe h…

It's been over a year, but I played around with PKI and installing your own self-signed root certs on iPhone and Android (for HTTPS) was not hard.

Re: Camera and microphone require HTTPS in Firefox 68

#138

Post by missblit » Wed, Jul 10, 2019, 1:56 AM UTC

peterlk wrote: post #132

petters wrote: post #2

It will still work on localhost, which is nice. It would be nice if it also worked on local IPs, like 192.168. . . Those do not work on Chrome, I think, which make mobile testing a bit more cumbersome.

To any browser developers out there, I beg you, please, please, please whitelist lvh.me. I am so tired of security restrictions making everything painful for lvh.me.

But nothing ensures that domain name will always point to localhost. So why should browsers trust it more than other HTTP domains? It's owned by one person, so DNS registration could lapse even with the best intentions.

Re: Camera and microphone require HTTPS in Firefox 68

#139

Post by admax88q » Wed, Jul 10, 2019, 1:57 AM UTC

nothrabannosir wrote: post #65

admax88q wrote: post #52

Earlier quoted context omitted.

I don't get why people who even admit that they dont trust these random npm packages can think its okay to ship them in production and put all their user's data at risk. It's malpractice.

I’d love to know a metric of trust and its relation to customer data. How many trust points for how much PII? I’m assuming it’s a logarithmic scale? And a Debian stable package gets , what, double the points of an npm package? Or I guess it depends on the weekly downloads? What about pip, gems, vim plugins, emacs packages (I’m looking at you melpa) , quicklisp, ... Then we can play an honest thought experiment: how m…

It's not a question of establishing an absolute scale of trust. It's about admitting that you consider npm packages to be insecure, but you run them in production anyways.

Imagine you believed that steel had a 10% chance of spontaneous combustion, regardless of whether its true or not, if you believe that and you still built a bridge out of it, that's malpractice.

Re: Camera and microphone require HTTPS in Firefox 68

#140

Post by mort96 » Wed, Jul 10, 2019, 1:58 AM UTC

Wowfunhappy wrote: post #135

mort96 wrote: post #130

Earlier quoted context omitted.

That's both true and completely irrelevant.

Well, it's relevant insofar as you're complaining to the wrong company. Does this behavior even exists in iOS Chrome? If it does, it exists in Mobile Safari as well.

I... wasn't complaining about Google though? I said you can't enable chrome://flags/#unsafely-treat-insecure-origin-as-secure (or an equivalent) on iOS, not that it's Google's fault that you can't.