Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome’s address bar will use https:// by default

blog.chromium.org

Post reply on HN
Print view View original

41–50 of 463 posts

Re: Chrome’s address bar will use https:// by default

#41

Post by sharedhostvet »

silvestrov wrote: post #36
colllectorof wrote: post #32

Earlier quoted context omitted.

>HTTPS adoption is now very high[1] I posted this in a separate comment and I will post it again. https://certbot.eff.org/hosting_providers HTTPS adoption is hard enough that the wast majority of shared hosting providers haven't automated cert provisioning and are delegating this process to their users. The push towards forced HTTPS has significant costs, which most people in this filter bubble don't want to honestly…

This filter bubble are of the very sensible conviction that those hosting providers then need to get their act together or go out of business. HTTPS is old tech. "Let's Encrypt" is free.

I can tell you from personal experience that they are in the process of going out of business.

Traditional shared hosts got their lunch eaten starting almost a decade ago with a combination of site builders like Weebly on the user friendly side and AWS on the technical side.

In 2013 most of my social group was friends I made in the shared hosting industry. Now I don't know a single person still working for any MSP as they've all needed to find greener pastures as the companies get bought up by conglomerate vampires that will milk the remaining customers (there aren't many new ones) for what they're worth until the companies finally die.

Looking to shared web hosts for guidance is like looking to 2005 to decide what's cutting edge.

They're done for. Shared hosting is over. RIP cPanel, Plesk, and the whole lot

Re: Chrome’s address bar will use https:// by default

#42

Post by banana_giraffe »

jefftk wrote: post #9
dfabulich wrote: post #4

There's no link to more technical detail. What happens when the site I type in the URL bar doesn't support HTTPS? Will it error out? (with a timeout?) Or will it automatically fallback to trying HTTP? (In that case, could a MITM block HTTPS to force the browser to try to downgrade?) EDIT: I see that the article says it will fall back, but Chrome Canary has options in chrome://flags, and it's not clear which option th…

"For sites that don’t yet support HTTPS, Chrome will fall back to HTTP when the HTTPS attempt fails." MITM is still an issue. At some point I hope browsers can switch to "you have to type http:// if you want HTTP", and this is a step in that direction. (Disclosure: I work for Google, speaking only for myself)

I'm curious if that includes falling back to HTTP when HTTPS has worked in the past.

I only ask because I'm curious what this will do with captive portal nonsense.

Re: Chrome’s address bar will use https:// by default

#43

Post by squaresmile »

SquareWheel wrote: post #38
cblconfederate wrote: post #24

Right, can it please stop hiding it though? URLs aren't prose

Hiding it? Just enable "Always Show Full URLs" in the omnibar.

Thanks, I can finally uninstall this extension [1] as a workaround for that. Fun times with Chrome.

[1] https://chrome.google.com/webstore/detail/suspicious-site-re...

Re: Chrome’s address bar will use https:// by default

#44

Post by ocdtrekkie »

birdman3131 wrote: post #29

How does it behave when the site nominally supports https but only uses a self signed cert? Many local network items are like this. in most cases it might be better to fallback to http but I am not sure.

FWIW, it is rapidly becoming the right choice to operate an internal trusted certificate authority, as browsers aggressively push HTTPS.

In part, because this is now needed to monitor your own network traffic at the edge.

Re: Chrome’s address bar will use https:// by default

#45

Post by CodesInChaos »

asplake wrote: post #31

Potential source of frustration: naked domains on http that upgrade to https after redirect to www or some other subdomain. It’s a problem to me now - if I name my naked .org site in GMail it assumes https. At some point I will have to host my own redirection service, just for this one issue. Side note: it beats me why browsers couldn’t agree a way to specify at least the first redirect in DNS, no web server needed f…

You'd need to authenticate that redirect, so it isn't as easy as it looks. (something like DANE and DNSSEC)

The benefit doesn't seem big to me. You're already running a http server for the original domain, and an https server for the target domain, so extending the http server for the original domain to https doesn't sound like a big step.

Re: Chrome’s address bar will use https:// by default

#46

Post by jeswin »

jefftk wrote: post #9
dfabulich wrote: post #4

There's no link to more technical detail. What happens when the site I type in the URL bar doesn't support HTTPS? Will it error out? (with a timeout?) Or will it automatically fallback to trying HTTP? (In that case, could a MITM block HTTPS to force the browser to try to downgrade?) EDIT: I see that the article says it will fall back, but Chrome Canary has options in chrome://flags, and it's not clear which option th…

"For sites that don’t yet support HTTPS, Chrome will fall back to HTTP when the HTTPS attempt fails." MITM is still an issue. At some point I hope browsers can switch to "you have to type http:// if you want HTTP", and this is a step in that direction. (Disclosure: I work for Google, speaking only for myself)

> "you have to type http:// if you want HTTP"

That makes sense only to programmers, who make a small fraction of users. Browsers are mainstream; we need to be more thoughtful.

Re: Chrome’s address bar will use https:// by default

#47

Post by bmicraft »

Black101 wrote: post #39
SquareWheel wrote: post #38

Earlier quoted context omitted.

Hiding it? Just enable "Always Show Full URLs" in the omnibar.

Default value matters ... it's a bit like opt-in vs opt-out

What's the point in having the protocol spelled out when you have the lock icon anyways? I don't think this would be a useful default.

Re: Chrome’s address bar will use https:// by default

#48

Post by reaperducer »

When the big push to HTTPS came around, I was all in favor of it. Now... I'm more skeptical. Not everything has to be HTTPS. And I've become aware that many of the sites I visit are HTTP only and will never become HTTPS because of their age, or the lack of technical ability of their owners. HTTPS also has the side effect of obsoleting older hardware for no real reason. I have devices that work perfectly fine, but can't be upgraded to the latest whiz-bang encryption du jour.

A vintage computer software archive doesn't need to be HTTPS. A local historical society doesn't need to be HTTPS. A color picker doesn't need to be HTTPS.

I still think HTTPS is a good thing, but I also see it as a way of marginalizing and eventually eliminating a very large portion of the content on the web. Much of it is the very content that made the web so popular in the first place.

I think I first became skeptical when Google said it would rank HTTP sites lower. This fits in with Google's general direction of making any content older than 4 years inaccessible, and creating its own information ecosystem in which to corral people. Google can now delist a huge swath of the internet and shrug its shoulders and say, "because security!"

I think a good compromise would be for browsers to make connecting to an HTTP web site a lot less scary. Yes, tell people the connection is old-fashioned, and may be public. But don't block the page and put up big red scary icons and make people enter the system password to view Aunt Harriet's Really Good Muffin Recipe. It just seems like the antithesis of what the web was built for.

Re: Chrome’s address bar will use https:// by default

#49

Post by OskarS »

melomal wrote: post #25
pornel wrote: post #13

That makes a lot of sense. HTTPS adoption is now very high[1], and this might push it a little bit further for sites that don't redirect to HTTPS automatically. I've been using Firefox in the experimental HTTPS-only mode, and the web is quite usable without cleartext HTTP. [1] https://transparencyreport.google.com/https/overview It's not a big change from security perspective though. HTTP requests shouldn't be gettin…

> HTTPS adoption is now very high[1] This is simply because they told SEO's that HTTPs takes precedent and effects ranking - if you want mass adoption of anything then just tell a bunch of SEOs that rankings will be effected (AMP is one that has thankfully not won the fight). Google passed it off as security but I cannot believe this to be the case when you see the shit that litters the Play Store.

What are you even saying? Are you implying that HTTPS is a bad thing because of... SEO? The Play Store? AMP? What is your point exactly?
Post reply on HN