Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome’s address bar will use https:// by default

blog.chromium.org

Post reply on HN
Print view View original

301–310 of 463 posts

Re: Chrome’s address bar will use https:// by default

#301

Post by jodrellblank »

kazen44 wrote: post #273
MaxBarraclough wrote: post #178

Earlier quoted context omitted.

On the face of it, it sounds simple enough: special treatment when the IP address is an IETF-designated private IPv4 address (e.g. 192.168.x.y). Is there some reason this wouldn't work, that I haven't thought of?

well, rfc1918 addresses just specify which ranges should not be advertised into the default free zone. (aka, the internet routing table). It says nothing about if a network is LAN or not. One could totally build a network with globally routed addresses, and not announce those addresses to the rest of the world.

> "One could totally build a network with globally routed addresses, and not announce those addresses to the rest of the world."

Could, and people do; I've worked on networks where the original people must have misunderstood networking and did the equivalent of using 10.0.0.0/8, 11.0.0.0/8, 12.0.0.0/8 for internal networks, including public /8s they didn't own, so they lost access to one or two chunks of the internet - and it never seemed to cause all that many problems for them working this way (so no motivation to do a big involved risky rework-everything project). We added new private network subnets for new build things, but never swapped everything over. It'll phase out eventually I guess.

Re: Chrome’s address bar will use https:// by default

#302

Post by Ajedi32 »

superkuh wrote: post #279
Ajedi32 wrote: post #182

Earlier quoted context omitted.

A human person can't be a DNS registrar either. TLS certs aren't a stamp of approval; they're just a statement saying "we've verified that this public key belongs to the owner of this domain".

That's true, but I can still type in an IP address and communicate with any webserver I want on the entire internet. I guess you don't remember in 2018 when Comodo revoked sci-hub's TLS certs under corporate political pressure. This style of revocation combined with HTTPS only browsers is effectively a block that can't be bypassed. I am not saying that the DNS system cannot be used for political attack. It obviously…

Still not seeing how that's any different from DNS. I mean yes, obviously it's another possible point of failure. But I don't see MITM protection as being any less important than name resolution on the modern web. Seems no less reasonable for a site to break due to lack of MITM protection than for it to break due to failure of name resolution. Normal users aren't going to be manually looking up and navigating to IP addresses anymore than they're going to be manually installing TLS certificates.

Re: Chrome’s address bar will use https:// by default

#303

Post by dan-robertson »

j1elo wrote: post #263
throw14082020 wrote: post #220

Earlier quoted context omitted.

70% of scenarios? If I were to guess, it would be 70% of your time that your happy with https, and 30% you don't. But its 99.9% or higher in reality. Also, did you know 80% of facts are made up? XD

That number was totally made up, of course :) that's why I quoted it... didn't really want to be too pedant and explicitly say it, but maybe I should have.

But the number matters to your point. Focusing on 70% of users to the detriment of 30% seems a lot less defensible than focusing on 99.9% of users to the detriment of 0.1%.

The claim you made was “chrome is hurting a large minority of users and they should make a browser in a more fair way” but this changes when you change your made up numbers to something more like “chrome is hurting a tiny minority of users with weird use-cases like me and I don’t like it”

FWIW, it feels like the problem is more that your use-cases don’t fit into web PKI, and I agree with you. But I don’t think harming the security of web browsing for the vast majority is the solution to those problems.

Re: Chrome’s address bar will use https:// by default

#304

Post by spockz »

heinrichhartman wrote: post #291
chpatrick wrote: post #259

Earlier quoted context omitted.

You can set up the users' machines so that they trust your certificate.

I have tried to do just that but ran into all kinds of difficulties: 1. Overhead: I have 5 devices that I own 3 of my wife and a smart TV. Setting all this us takes a lot of time, even if it worked fine. 2. What about visitors to my home, that I want to give access? They need the cert as well together with lengthy instructions on how to install it. 3. How do I even install certs on an iPhone? 4. Firefox uses it's own…

I have been looking at using MDM for my iPhone so I can install trusted root certs and require it to be on vpn when not using a specific list of WiFi networks.

It is a hassle and as far as I could see it requires resetting the device and I’m not sure I can restore my backup over it and retain both.

Re: Chrome’s address bar will use https:// by default

#305

Post by chovybizzass »

simias wrote: post #111

I wish there was a solution for those of us who develop web interfaces for embedded products designed to live on LAN, often without any internet access and no well defined domain name. I'm all for HTTPS everywhere but right now for my products it's either: https with self-signed certificate, which basically makes any modern browser tell its user that they're in a very imminent danger of violent death should they deci…

I think all you have to do is redirect https to http and it'll work. They are just "defaulting" to https

Re: Chrome’s address bar will use https:// by default

#306

Post by louis-lau »

birdman3131 wrote: post #29

How does it behave when the site nominally supports https but only uses a self signed cert? Many local network items are like this. in most cases it might be better to fallback to http but I am not sure.

It's mentioned in the blog post, the link to which you're commenting on.

Re: Chrome’s address bar will use https:// by default

#308

Post by xg15 »

alecbz wrote: post #144
j1elo wrote: post #136

Earlier quoted context omitted.

It's worrying how they are improving the case for "70%" scenarios, while crippling it for the other 30%, without recourse. It's not even funny any more. What happens with offline LAN? And the ideal IoT devices that we would all want to have? (I mean those we dream about in all IoT HN posts, where the rants typically are that no internet connection should be needed for most of these kinds of devices) What about offlin…

> without recourse Doesn't the post say they'll fall back to http if the https attempt fails? > For sites that don’t yet support HTTPS, Chrome will fall back to HTTP when the HTTPS attempt fails. The only change here seems like it's that, from the user's perspective, initial connections to http-only sites will be a bit slower (vs. the opposite which used to be true: initial connections to https-only sites were slower…

> initial connections to http-only sites will be a bit slower (vs. the opposite which used to be true: initial connections to https-only sites were slower).

More than a bit. For HTTPS-only sites, the site could serve a stub HTTP endpoint on port 80 that redirects to HTTPS. The redirect causes maybe some milliseconds to a few seconds (worst case) of latency.

HTTP-only on the other hand can't do a HTTPS stub as easily (as the primary reason you'd want HTTP-only is probably that you don't want/can't deal with the certificate management - if you can set up a redirect from HTTPS to HTTP, you might as well go full HTTPS)

So the only option for HTTP-only is to not open port 443 at all - meaning Chrome has to wait out the 30 seconds (!) network timeout until it can try the fallback. So pure-HTTP sites would become a lot more unpleasant to use.

(A site might be able to cut this short by actively refusing the TCP handshake and sending an RST packet - or by opening and immediately closing the connection. I don't know how Chrome would react to this. In any case, that's likely not what HTTP-only sites in the wild are doing, so they'll need to update their software - at which point, they might just as well spend the effort to switch to HTTPS)

Re: Chrome’s address bar will use https:// by default

#310

Post by louis-lau »

goodside wrote: post #258

This is a great instance of https://xkcd.com/1172/ for me. "example.com" is the only domain name I intentionally load over HTTP in Chrome, so this change breaks my workflow. Many for-pay wifi networks (e.g. on airplanes) are designed to intercept all HTTP requests from guest users, redirecting the browser to a login/signup page. Until you log in HTTPS is blocked, so you have to try to open a domain Chrome doesn't rec…

Did you read the blog post? It will now use http if https fails. So http only sites will still work for this.
Post reply on HN