Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome will mark all HTTP sites as ‘not secure’ starting in July

theverge.com

Post reply on HN
Print view View original

41–50 of 143 posts

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#41

Post by communist_ »

robin_reala wrote: post #9
bowlich wrote: post #8

Because my statically generated blog really needs https. This is really going to create an additional layer of inconvenience for people who just want to drop some html documents in an ftp folder and be done with it.

But your static blog isn’t secure served over HTTP. And that’s fine if you choose it.

This is completely untrue. If HTTP is enough for Debian packages it's enough for my blog. It's a myth that HTTPS is the only way for the Web to be secure; there are many ways to encrypt and verify data. Google it just trying to consolidate its power over the Internet by making us rely on centralized certificate authorities.

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#43

Post by meta_AU »

wildpeaks wrote: post #7

If you wonder how to get HTTPS for your local virtual hosts: 1. create a local CA 2. create a certificate using that local CA 3. Then you can add the CA in your trusted authorities (Firefox does need an extra step: either enable the "security.enterprise_roots.enabled" flag, either import the CA certificate manually in it). Details at: https://gist.github.com/cecilemuller/9492b848eb8fe46d462abeb...

The other option is to register a domain and use that to get either LetsEncrypt cetts or purchase a wildcard.

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#44

Post by ysavir »

hughes wrote: post #16
bowlich wrote: post #8

Because my statically generated blog really needs https. This is really going to create an additional layer of inconvenience for people who just want to drop some html documents in an ftp folder and be done with it.

Nobody's saying it does - including Chrome. The browser will simply (and correctly) show "Not Secure" in the address bar when next to the url viewing your blog. If a user doesn't have an expectation of security, they won't be bothered or perhaps even notice.

Which is great for users that understand what these security concerns are all about, like typical HN folk. But these people are probably aware of cyber security already, so not much gain here.

And people that _don't_ understand cyber security will have no context for what "not secure" means, and may needlessly avoid a variety of HTTP static-HTML sites, where these security issues aren't that great a concern.

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#45

Post by criddell »

skolemtotem wrote: post #14
robin_reala wrote: post #9

Earlier quoted context omitted.

But your static blog isn’t secure served over HTTP. And that’s fine if you choose it.

Oh no, someone's going to MITM my shitty blog posts. "Secure" is a word that only makes sense with context, and without that context it only serves to cause irrational panic. I wonder why Google's really doing this.

It's not irrational. Remember the Great Cannon of China attack in 2015? That attack tool works by modifying the responses to insert code to attack the victim. If your shitty blog posts aren't over https, then they can be used to attack other people.

In a way, it's a little like a public health argument. You might not be worried about measles but you should still be vaccinated for the sake of the herd.

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#46

Post by xienze »

meta_AU wrote: post #43
wildpeaks wrote: post #7

If you wonder how to get HTTPS for your local virtual hosts: 1. create a local CA 2. create a certificate using that local CA 3. Then you can add the CA in your trusted authorities (Firefox does need an extra step: either enable the "security.enterprise_roots.enabled" flag, either import the CA certificate manually in it). Details at: https://gist.github.com/cecilemuller/9492b848eb8fe46d462abeb...

The other option is to register a domain and use that to get either LetsEncrypt cetts or purchase a wildcard.

That’s what I do. And LE actually supports wildcards, so that’s no problem. If your local network is firewalled off LE can still issue you a cert so long as you use DNS record validation.

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#47

Post by tialaramex »

stefan_ wrote: post #5

So, what is the Chromes team solution for local network devices like routers? Proxy it over the manufacturers server for a complete loss of any privacy and security, but hey, there is a green check mark then?

The problem is really _naming_ these devices first of all. If they have (global) names there's no problem to issue a certificate for those names.

But so often the device doesn't have any name at all, so it's maybe 10.0.0.1, and so is everything else, the problem only appears to be in the security layer because that's the first place which absolutely insists that you can't have a situation where everybody is just named "Bruce" with no other identifier.

Where it does have a name, the name is often not part of the global namespace. At least here we can fix that with a namespace suffix. Sold five million routers with serial numbers? Name them $serialnumber.routers.your-company.example and problem solved. Now that they have a name, issuing them certificates isn't difficult.

(Yes, a commercial vendor who'll hook you up with five million certificates won't do it for free. The little rubber feet and the half-arsed English translation of the instruction manual weren't free either. Too bad)

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#48

Post by stefan_ »

0x0 wrote: post #40
stefan_ wrote: post #32

Earlier quoted context omitted.

That's exactly the problem. Devices in the local network can not partake in the public CA infrastructure. So they run self-signed certificates, which is probably a small security win over plain HTTP, but then customers are faced with a scary "someone is stealing your data" page before ever seeing the configuration page. That's a no go, so most stay on HTTP, but as we can tell from this announcement, time is running o…

I think you are jumping to conclusions for no good reason here, I think it's absolutely unlikely to happen that browsers remove http support. Worst case they'll add a clickthrough screen similar to the invalid ssl interstitials of today. Surely you can deal with an extra click through when logging in to your wifi router if you can't be bothered to install an ssl cert for it?

I can deal, but we're looking for the Dropbox solution here. This is only going to become worse with all the IoT hype, and if it's not solved, it will just mean all these devices will go through the manufacturer, all the time.

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#49

Post by criddell »

ksri wrote: post #2

Is this also true for localhost, or does localhost get special treatment? What is a good way to get https certificates for localhost other than self signed certificates?

Will it cause a problem for you if your browser displays gray text saying your connection to localhost is not secure?

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#50

Post by linuxftw »

All traffic encrypted means no one can see your outbound transmission data, including you!

No way to verify what you're sending on the wire if the application is proprietary (and statically compiled) without dumping memory, which would be quite odious.

Post reply on HN