Chrome’s address bar will use https:// by default • Hacker News Board

Re: Chrome’s address bar will use https:// by default

#151

Post by Ajedi32 » Tue, Mar 23, 2021, 5:58 PM UTC

xrisk wrote: post #130

est31 wrote: post #94

Earlier quoted context omitted.

The info "is https available" is not secured either. The ISP can just block any packet on port 443 and force http that way. It would break links but wouldn't break people entering the address via the URL bar. A real improvement in security would be Google caching the data, and either offering it via a custom API or just signing it and appending it to their 8.8.8.8 DNS responses. Per default, Chrome already sends the…

HSTS preload lists exist. And the scenario where an ISP blocks https connections is unrealistic, the server can simply refuse to serve content on http other than redirects.

We're not talking about preloaded HSTS. In such cases this change makes zero difference; Chrome already would have made the initial connection over HTTPS.

And it doesn't matter whether the legitimate server is refusing to serve plaintext HTTP if you're not talking to the legitimate server in the first place. The attacker can serve whatever they want.

Re: Chrome’s address bar will use https:// by default

#152

Post by antihero » Tue, Mar 23, 2021, 5:58 PM UTC

colllectorof wrote: post #26

Meanwhile, here is the state of certbot support on shared hosting: https://certbot.eff.org/hosting_providers Yellow means you have to jump through hoops as a user. Even though the whole point of managed/shared hosting is that you don't. So either all those companies whose primary business is to provide hosting are incompetent, or "Let's Encrypt is super easy" narrative is false.

> all those companies whose primary business is to provide hosting are incompetent,

Bingo

Re: Chrome’s address bar will use https:// by default

#153

Post by josefx » Tue, Mar 23, 2021, 5:59 PM UTC

alecbz wrote: post #145

prepend wrote: post #56

Earlier quoted context omitted.

I like using http where appropriate and not wasting resources. I publish a blog and there’s no need for https. Adding https just adds a little more effort and provides no benefit to the user. I guess if you count the ISP not knowing, but Google knowing, that you’re visiting my blog, then that’s a reason. But that’s a user issue, not a server issue. Practically, my host does all the cert stuff for me and it’s not hard…

You don't care if your blog's content gets MITM'd?

You mean like by someone throwing up a huge warning that this page is made by the devil himself and unless he recites the right combination of holy words there is nothing you can do to access it? Ran into a few pages that were hijacked that way, some of them at least seemed to go to the expected content when I got rid of the https.

Re: Chrome’s address bar will use https:// by default

#154

Post by Spivak » Tue, Mar 23, 2021, 5:59 PM UTC

simias wrote: post #127

liveoneggs wrote: post #117

Earlier quoted context omitted.

let's encrypt with *.lan.mydomain.com via DNS validation, installed all over where needed, and annoying to update every 90 days because it's in weird/internal/non-standard places :)

I develop broadcast TV equipments which are often rented all over the place for short amounts of time, often don't have any direct internet access etc... I simply cannot make any assumption about the network these devices will run, and can certainly not rely on any sort of DNS validation. Virtually 100% of the time the devices are addressed directly by IPv4. I really can't think of a solution for this situation. For…

I think you would like how Plex did it.

https://blog.filippo.io/how-plex-is-doing-https-for-all-its-...

Re: Chrome’s address bar will use https:// by default

#155

Post by heavyset_go » Tue, Mar 23, 2021, 6:03 PM UTC

sharedhostvet wrote: post #41

silvestrov wrote: post #36

Earlier quoted context omitted.

This filter bubble are of the very sensible conviction that those hosting providers then need to get their act together or go out of business. HTTPS is old tech. "Let's Encrypt" is free.

I can tell you from personal experience that they are in the process of going out of business. Traditional shared hosts got their lunch eaten starting almost a decade ago with a combination of site builders like Weebly on the user friendly side and AWS on the technical side. In 2013 most of my social group was friends I made in the shared hosting industry. Now I don't know a single person still working for any MSP as…

Managed services are a godsend for SMBs that, for example, need a WordPress install but don't know how or when to upgrade it.

Not every business needs to hire developers and devops to run their services on AWS.

Re: Chrome’s address bar will use https:// by default

#156

Post by EveYoung » Tue, Mar 23, 2021, 6:03 PM UTC

j1elo wrote: post #136

simias wrote: post #111

I wish there was a solution for those of us who develop web interfaces for embedded products designed to live on LAN, often without any internet access and no well defined domain name. I'm all for HTTPS everywhere but right now for my products it's either: https with self-signed certificate, which basically makes any modern browser tell its user that they're in a very imminent danger of violent death should they deci…

It's worrying how they are improving the case for "70%" scenarios, while crippling it for the other 30%, without recourse. It's not even funny any more. What happens with offline LAN? And the ideal IoT devices that we would all want to have? (I mean those we dream about in all IoT HN posts, where the rants typically are that no internet connection should be needed for most of these kinds of devices) What about offlin…

> IP addresses, single label domains, and reserved hostnames such as test/ or localhost/ will continue defaulting to HTTP.

According to the post this shouldn't be an issue.

Re: Chrome’s address bar will use https:// by default

#157

Post by makeworld » Tue, Mar 23, 2021, 6:05 PM UTC

fireattack wrote: post #95

andrewfromx wrote: post #65

what about http://neverssl.com/ ? I use that all the time to force a wifi connect dialog to pop up.

You have to type http:// then.

No, you don't. It will just load as always. All this change means is that HTTPS will be tried first.

Re: Chrome’s address bar will use https:// by default

#158

Post by zzo38computer » Tue, Mar 23, 2021, 6:06 PM UTC

I dislike both behaviours.

I prefer that if the scheme is not entered, it is treated as a relative URL. (I have managed to customize Firefox to do this.)

I also dislike the way "secure contexts" work entirely. Whether or not those features are enabled should depend on whether or not the user enabled them, not on whether or not the site uses HTTPS.

(I also think that a better web browser should be made, which would be mostly rewritten entirely rather than using the existing browsers, since they have so many problems.)

Re: Chrome’s address bar will use https:// by default

#159

Post by benbristow » Tue, Mar 23, 2021, 6:06 PM UTC

simias wrote: post #127

liveoneggs wrote: post #117

Earlier quoted context omitted.

let's encrypt with *.lan.mydomain.com via DNS validation, installed all over where needed, and annoying to update every 90 days because it's in weird/internal/non-standard places :)

I develop broadcast TV equipments which are often rented all over the place for short amounts of time, often don't have any direct internet access etc... I simply cannot make any assumption about the network these devices will run, and can certainly not rely on any sort of DNS validation. Virtually 100% of the time the devices are addressed directly by IPv4. I really can't think of a solution for this situation. For…

Perhaps you could distribute an Electron style client that has a self-signed certificate pre-configured and ask your clients to interface with the equipment via that?

If you were using Electron you wouldn't have to worry about browser support either as you'd just have to target Chrome/Blink.

Just brainstorming ideas here, someone will probably shoot me down.

Re: Chrome’s address bar will use https:// by default

#160

Post by xg15 » Tue, Mar 23, 2021, 6:06 PM UTC

londons_explore wrote: post #134

simias wrote: post #127

Earlier quoted context omitted.

I develop broadcast TV equipments which are often rented all over the place for short amounts of time, often don't have any direct internet access etc... I simply cannot make any assumption about the network these devices will run, and can certainly not rely on any sort of DNS validation. Virtually 100% of the time the devices are addressed directly by IPv4. I really can't think of a solution for this situation. For…

DNS validation can entirely be done by a server on the internet, which does all the stuff necessary to get the certificate, and then gives the certificate to your end user device. All the end user device needs is a connection to the internet once per 90 days. The vast majority of networks have sufficient network connectivity for this.

> All the end user device needs is a connection to the internet once per 90 days. The vast majority of networks have sufficient network connectivity for this.

I'm no expert on long-tail use cases, but I'd imagine that most networks either have internet connectivity or they don't. I can't think of many situations where you'd only have internet once every 90 days.

Of course one could argue that 90 days long is enough so an employee could go around with a memory stick and manually copy the certificate to every device - which is theoretically possible but sounds like a ridiculous thing to do just to keep a web interface workable. (And even then, you'd somehow need a unique certificate for every device)