Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome’s address bar will use https:// by default

blog.chromium.org

Post reply on HN
Print view View original

381–390 of 463 posts

Re: Chrome’s address bar will use https:// by default

#381

Post by feross »

NickNameNick wrote: post #300
qwertox wrote: post #278

Earlier quoted context omitted.

> It's worrying how they are improving the case for "70%" scenarios, while crippling it for the other 30%, without recourse. It's not even funny any more. I constantly have issues with this address bar hiding the scheme and even the www. One issue is when I quickly want to select some parameters or delete parts of the url in order to "up" one level. What drives me absolutely insane is their inconsitent autocomplete f…

It's a silly hack, but if you install googles "Suspicious site reporter" extension for chrome, then the chrome address bar retains the full URL all the time.

You can also right click the address bar > "Always show full URLs".

Re: Chrome’s address bar will use https:// by default

#382

Post by [deleted] »

qwertox wrote: post #278
j1elo wrote: post #136

Earlier quoted context omitted.

It's worrying how they are improving the case for "70%" scenarios, while crippling it for the other 30%, without recourse. It's not even funny any more. What happens with offline LAN? And the ideal IoT devices that we would all want to have? (I mean those we dream about in all IoT HN posts, where the rants typically are that no internet connection should be needed for most of these kinds of devices) What about offlin…

> It's worrying how they are improving the case for "70%" scenarios, while crippling it for the other 30%, without recourse. It's not even funny any more. I constantly have issues with this address bar hiding the scheme and even the www. One issue is when I quickly want to select some parameters or delete parts of the url in order to "up" one level. What drives me absolutely insane is their inconsitent autocomplete f…

[deleted]

Re: Chrome’s address bar will use https:// by default

#383

Post by grahamburger »

akdor1154 wrote: post #358
j1elo wrote: post #136

Earlier quoted context omitted.

It's worrying how they are improving the case for "70%" scenarios, while crippling it for the other 30%, without recourse. It's not even funny any more. What happens with offline LAN? And the ideal IoT devices that we would all want to have? (I mean those we dream about in all IoT HN posts, where the rants typically are that no internet connection should be needed for most of these kinds of devices) What about offlin…

I wonder if a scheme could be invented where your router could be responsible for issuing certs to local devices. Forgetting about the impossibilities of industry adoption, would such a scheme be possible? E.g. your router/DHCP controller/AD box gives an IoT device a DHCP ip and maybe a DNS address, and additionally it will provision a cert+key to that device by some standard protocol (keeping this secure might be im…

One problem is that it's easy to inject malicious DHCP on to any network you have access to, and you can then route all traffic to yourself (by telling clients that you are the gateway.) This kind of attack is partially mitigated because of TLS - redirecting all traffic to yourself isn't particularly useful if it's all encrypted. But if you could issue a cert along with the DHCP it'd be game over for everyone on the network.

Re: Chrome’s address bar will use https:// by default

#384

Post by grahamburger »

simias wrote: post #111

I wish there was a solution for those of us who develop web interfaces for embedded products designed to live on LAN, often without any internet access and no well defined domain name. I'm all for HTTPS everywhere but right now for my products it's either: https with self-signed certificate, which basically makes any modern browser tell its user that they're in a very imminent danger of violent death should they deci…

This is a huge pain point for me as a user, too. I interact with a lot of managed network devices that have web UIs as their primary configuration method. All existing options for this stink. At least Firefox still lets me click through the security warnings - in Chrome you have to know the 'thisisunsafe' incantation, and who knows when that will just go away. There has to be a better way.

Re: Chrome’s address bar will use https:// by default

#385

Post by stevenwliao »

tgsovlerkhgsel wrote: post #205
Sanzig wrote: post #54

Earlier quoted context omitted.

And for technical users who find AWS/GCP/Azure and friends too expensive for whatever reason, there's enough small bargain basement VPS providers around that still beat the prices of the shared hosting providers while providing way more flexibility. I run my personal blog using a mom-and-pop KVM VPS provider that costs $2 per month, and I get full control over whatever stack I want to run. Shared hosting is awful, I…

> Shared hosting is awful Depends on your use case. For my use case, I upload a bunch of HTML files via SFTP, and it just keeps working. I don't have to deal with the server software, someone who can dedicate a lot more time does that for me for a nominal cost (because keeping the server for 10000 people updated is only marginally more difficult than me keeping my own server updated). I pay the same or less than I'd…

Can you use Github Pages?

Re: Chrome’s address bar will use https:// by default

#386

Post by gjs278 »

tgsovlerkhgsel wrote: post #205
Sanzig wrote: post #54

Earlier quoted context omitted.

And for technical users who find AWS/GCP/Azure and friends too expensive for whatever reason, there's enough small bargain basement VPS providers around that still beat the prices of the shared hosting providers while providing way more flexibility. I run my personal blog using a mom-and-pop KVM VPS provider that costs $2 per month, and I get full control over whatever stack I want to run. Shared hosting is awful, I…

> Shared hosting is awful Depends on your use case. For my use case, I upload a bunch of HTML files via SFTP, and it just keeps working. I don't have to deal with the server software, someone who can dedicate a lot more time does that for me for a nominal cost (because keeping the server for 10000 people updated is only marginally more difficult than me keeping my own server updated). I pay the same or less than I'd…

umm no it’s still awful in that case. you could haves transferred out of your host to something more reliable in the time it took you to make this post.

Re: Chrome’s address bar will use https:// by default

#387

Post by fomine3 »

xrisk wrote: post #130
est31 wrote: post #94

Earlier quoted context omitted.

The info "is https available" is not secured either. The ISP can just block any packet on port 443 and force http that way. It would break links but wouldn't break people entering the address via the URL bar. A real improvement in security would be Google caching the data, and either offering it via a custom API or just signing it and appending it to their 8.8.8.8 DNS responses. Per default, Chrome already sends the…

HSTS preload lists exist. And the scenario where an ISP blocks https connections is unrealistic, the server can simply refuse to serve content on http other than redirects.

Theoretically ISP can provide a transparent proxy to translate HTTPS to HTTP (but with some feature degradation). It could happen in restricted countries.

Re: Chrome’s address bar will use https:// by default

#388

Post by kenneth »

simias wrote: post #111

I wish there was a solution for those of us who develop web interfaces for embedded products designed to live on LAN, often without any internet access and no well defined domain name. I'm all for HTTPS everywhere but right now for my products it's either: https with self-signed certificate, which basically makes any modern browser tell its user that they're in a very imminent danger of violent death should they deci…

I wonder if you'd be able to use a .local name and somehow get a proper signed certificate for it, which you embed into your local device.

Alternatively (and this is pretty hacky, but should work), you get a full domain unique to your device, e.g. mydevice-admin.com, and you require users to run a small installation script on their local devices that'll map that hostname to the local IP of the device. If not setup, it'd show a webpage that has instructions on how to run said installer. Then you embed the certificate on your devices.

There's some obvious security risks on this (if someone could extract the certificate and MITM the website and then trick people into running a malicious installer…) but at least your default experience would have the desired green check-marks.

(These are all probably shitty ideas.)

Re: Chrome’s address bar will use https:// by default

#389

Post by rblatz »

colejohnson66 wrote: post #351
isignal wrote: post #346

Earlier quoted context omitted.

This is not true, you can set your host to trust a self signed certificate without much difficulty. Check out this tool for example https://github.com/FiloSottile/mkcert (prev discussion at https://news.ycombinator.com/item?id=17748208 )

Self signing doesn’t let the world access my website without some scary warning.

That’s irrelevant to this discussion about hosting sites on a LAN with no internet access.

If you need https on the public internet you need a trusted cert.

Re: Chrome’s address bar will use https:// by default

#390

Post by katbyte »

heinrichhartman wrote: post #291
chpatrick wrote: post #259

Earlier quoted context omitted.

You can set up the users' machines so that they trust your certificate.

I have tried to do just that but ran into all kinds of difficulties: 1. Overhead: I have 5 devices that I own 3 of my wife and a smart TV. Setting all this us takes a lot of time, even if it worked fine. 2. What about visitors to my home, that I want to give access? They need the cert as well together with lengthy instructions on how to install it. 3. How do I even install certs on an iPhone? 4. Firefox uses it's own…

15$ a year for a domain, throw traffic through local [split?] dns and traefik with the lets encrypt dns challenge and call it a day? i have over 25 internal domains & services with 25 certs auto renewing and no one can tell - it just works and is easier the self signing certs and loading them into whatever rando service or device your trying to secure
Post reply on HN