Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome’s address bar will use https:// by default

blog.chromium.org

Post reply on HN
Print view View original

281–290 of 463 posts

Re: Chrome’s address bar will use https:// by default

#281

Post by Pxtl »

simias wrote: post #111

I wish there was a solution for those of us who develop web interfaces for embedded products designed to live on LAN, often without any internet access and no well defined domain name. I'm all for HTTPS everywhere but right now for my products it's either: https with self-signed certificate, which basically makes any modern browser tell its user that they're in a very imminent danger of violent death should they deci…

I wish we could get industry standard making .local official, then we could get browser-level support for ".local is allowed to be self-signed". Of course, a crapload of software still recommends against .local. And consumer routers and the like don't create a nice .local domain for all your crap.

Nevermind.

Re: Chrome’s address bar will use https:// by default

#282

Post by danShumway »

foosome wrote: post #262
danShumway wrote: post #80

Earlier quoted context omitted.

> The push towards forced HTTPS has significant costs, which most people in this filter bubble don't want to honestly discuss. I agree, but I'll push back by saying that delaying HTTPS adoption and getting lax about it has a much higher cost -- and that is similarly a cost that most people pushing back against HTTPS either downplay or refuse to acknowledge. And more than that, those critics have shown that they're no…

Cloudflare does MITM. MITM is cited as a reason in this thread for force HTTPS upon everyone, even on static blog pages. Kind of ironic.

Not ironic at all.

An explicit caching server that I integrate into my site on purpose is a totally different category of device from a random router sitting in an airport.

This is like arguing that because Linode can log into my server and examine/edit my files, then we might as well stop requiring a password when random people online try to SSH onto the machine. Trusted agents and untrusted agents are not the same.

Re: Chrome’s address bar will use https:// by default

#283

Post by aasasd »

pornel wrote: post #13

That makes a lot of sense. HTTPS adoption is now very high[1], and this might push it a little bit further for sites that don't redirect to HTTPS automatically. I've been using Firefox in the experimental HTTPS-only mode, and the web is quite usable without cleartext HTTP. [1] https://transparencyreport.google.com/https/overview It's not a big change from security perspective though. HTTP requests shouldn't be gettin…

Funny thing, Linux users clearly lag behind in the adoption, from that graph. You can't even brush it off as ‘who even uses Chrome on Linux’, since it's just the share among whatever users Chrome has there. (Though perhaps those are some weird bozos.)

Come to think of it, these might be just devs testing their own non-production sites?

Also apparently Google supports the movement of barely readable text on the web.

Re: Chrome’s address bar will use https:// by default

#284

Post by capitainenemo »

INTPenis wrote: post #195
simias wrote: post #111

I wish there was a solution for those of us who develop web interfaces for embedded products designed to live on LAN, often without any internet access and no well defined domain name. I'm all for HTTPS everywhere but right now for my products it's either: https with self-signed certificate, which basically makes any modern browser tell its user that they're in a very imminent danger of violent death should they deci…

Yeah I came here to say just that. It's really annoying when Firefox is stuck on https for some reason, maybe history? So I have to test if one of my LAN services works with curl. I think it has to do with history so I have to clear all history for that site and then start using it with http and it should work fine. This is only Firefox.

Strict-Transport-Security perhaps? My preferred method for testing is a clean profile (firefox -no-remote -P) or just ctrl-shift-p to open private browsing which does not read SiteSecurityServiceState.txt

Re: Chrome’s address bar will use https:// by default

#285

Post by ThrustVectoring »

TedDoesntTalk wrote: post #233
tony101 wrote: post #176

Earlier quoted context omitted.

> "I'm all for HTTPS everywhere but right now for my products it's either: https with self-signed certificate, which basically makes any modern browser tell its user that they're in a very imminent danger of violent death should they decide to proceed, or just go with good old HTTP but then you hit all sorts of limitations, and obviously zero security." How about what Plex did for its self-hosted media servers? "Firs…

How does the client learn the full domain name (the one with the hash)?

Presumably the hash is deterministic and uses data that the client had access to when making the old style of request

Re: Chrome’s address bar will use https:// by default

#286

Post by bullen »

jefftk wrote: post #9
dfabulich wrote: post #4

There's no link to more technical detail. What happens when the site I type in the URL bar doesn't support HTTPS? Will it error out? (with a timeout?) Or will it automatically fallback to trying HTTP? (In that case, could a MITM block HTTPS to force the browser to try to downgrade?) EDIT: I see that the article says it will fall back, but Chrome Canary has options in chrome://flags, and it's not clear which option th…

"For sites that don’t yet support HTTPS, Chrome will fall back to HTTP when the HTTPS attempt fails." MITM is still an issue. At some point I hope browsers can switch to "you have to type http:// if you want HTTP", and this is a step in that direction. (Disclosure: I work for Google, speaking only for myself)

How does HTTPS certificates solve MITM?

To me it seems HTTPS _IS_ the MITM... namely the certificate authority!

Re: Chrome’s address bar will use https:// by default

#287

Post by colllectorof »

j1elo wrote: post #136
simias wrote: post #111

I wish there was a solution for those of us who develop web interfaces for embedded products designed to live on LAN, often without any internet access and no well defined domain name. I'm all for HTTPS everywhere but right now for my products it's either: https with self-signed certificate, which basically makes any modern browser tell its user that they're in a very imminent danger of violent death should they deci…

It's worrying how they are improving the case for "70%" scenarios, while crippling it for the other 30%, without recourse. It's not even funny any more. What happens with offline LAN? And the ideal IoT devices that we would all want to have? (I mean those we dream about in all IoT HN posts, where the rants typically are that no internet connection should be needed for most of these kinds of devices) What about offlin…

>It's worrying how they are improving the case for "70%" scenarios, while crippling it for the other 30%, without recourse. It's not even funny any more.

It's even less funny when you realize that the class of devices that gets effectively crippled includes the wast majority of all IIoT devices. Including ones that run manufacturing and power generation. Yeah, your precious personal website is now secure from MITM attacks. The factory that made your car, however, uses critical infrastructure controlled by web interfaces with no encryption at all. Congrats.

Re: Chrome’s address bar will use https:// by default

#288

Post by trvz »

danShumway wrote: post #197
simias wrote: post #111

I wish there was a solution for those of us who develop web interfaces for embedded products designed to live on LAN, often without any internet access and no well defined domain name. I'm all for HTTPS everywhere but right now for my products it's either: https with self-signed certificate, which basically makes any modern browser tell its user that they're in a very imminent danger of violent death should they deci…

The very partial solution that I've been experimenting with and trying to refine is to "abuse" DNS records and Certbot's DNS tests so that I can have a bunch of public subdomains that point at intranet sites.[0] There's no rule that says you can't point a DNS record at a local IP. This really isn't a full solution though because there are instances where you don't want a public DNS record at all. It's also not partic…

Your solution comes to closest to mine, so I'll comment under here:

- Register the domain names you'll use in your LAN, point them to a public VPS and generate a wildcard TLS certificates.

- Copy the certificates to the servers in your LAN. This is the annoying part, as it needs to be done after every renewal (90 days with LE).

- Have Pi-hole in your LAN. It's necessary for security reasons to every serious IT professional anyway. It allows to set local DNS records - configure your domain names to point to the LAN servers.

This way, you get valid certificates on private servers without exposing DNS records into the public, without having to configure each client individually. Other people here still using self signed certificates are crazy...

Re: Chrome’s address bar will use https:// by default

#289

Post by 10000truths »

Leherenn wrote: post #247
rcdwealth wrote: post #216

Earlier quoted context omitted.

Make your own CA, install on each computer, install certificates, voila.

Telling your clients to install your certificate in their computer/browser store is not very practical. And they will need to do that regularly.

It shouldn’t be practical, that’s by design. Imagine if every captive portal had you install their root certificate to access the WiFi, with just the click of a button.

Re: Chrome’s address bar will use https:// by default

#290

Post by reaperducer »

xg15 wrote: post #160
londons_explore wrote: post #134

Earlier quoted context omitted.

DNS validation can entirely be done by a server on the internet, which does all the stuff necessary to get the certificate, and then gives the certificate to your end user device. All the end user device needs is a connection to the internet once per 90 days. The vast majority of networks have sufficient network connectivity for this.

> All the end user device needs is a connection to the internet once per 90 days. The vast majority of networks have sufficient network connectivity for this. I'm no expert on long-tail use cases, but I'd imagine that most networks either have internet connectivity or they don't. I can't think of many situations where you'd only have internet once every 90 days. Of course one could argue that 90 days long is enough s…

I can't think of many situations where you'd only have internet once every 90 days.

Having worked in broadcast news, I can think of hundreds.

News doesn't happen in the newsroom. It happens in the field. And very often in places without internet access. Sometimes for weeks or months at a time. (Think siege at Waco, plane crashes, hurricanes, etc.)

Post reply on HN