Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome’s address bar will use https:// by default

blog.chromium.org

Post reply on HN
Print view View original

441–450 of 463 posts

Re: Chrome’s address bar will use https:// by default

#441

Post by colejohnson66 »

rblatz wrote: post #389
colejohnson66 wrote: post #351

Earlier quoted context omitted.

Self signing doesn’t let the world access my website without some scary warning.

That’s irrelevant to this discussion about hosting sites on a LAN with no internet access. If you need https on the public internet you need a trusted cert.

But that’s my point, and many others’. Sure, we can self sign, but it’s useless for the WWW. You’re forced to pay up to one of the few certificate providers. Thankfully, Let’s Encrypt has made it free and easier, but it’s not a no-brainer.

Re: Chrome’s address bar will use https:// by default

#442

Post by prepend »

josefx wrote: post #426
prepend wrote: post #396

Earlier quoted context omitted.

There’s certainly risk, but I don’t think converting all traffic to ssl is worth it to mitigate the risk. I’ve never run into this situation in many years.

My comment was actually meant to be sarcastic and a bit over the top. The hijacker in this case would be the browser telling me that the page is not secure and as far as I remember valid certs are enforced to the point where a user can't bypass the error in some cases. In my experience https has always been more of a hurdle when I was looking for some obscure information hidden away on barely maintained websites.

I remember where it used to be fun to do stuff like that, or reverse all the images in pages, etc so thought it was a reference to just general monkeying around with http traffic that won’t work with https.

I get maybe 20 hits a year so I would probably think it funny if someone was interested enough to do this.

Re: Chrome’s address bar will use https:// by default

#443

Post by fluidcruft »

tialaramex wrote: post #424
fluidcruft wrote: post #249

Earlier quoted context omitted.

Oh interesting. Firefox says it's both enabled and set to use 1.1.1.1, and I figured that nothing would resolve if it wasn't... but if https://1.1.1.1/help is correct then it's not actually working and something else is happening. I know I tried setting and disabling that when I was testing but I saw no change. I don't remember setting 1.1.1.1 but I may have enabled DoH. I'll see if changing the DNS server in firefox…

> Not really sure what the point of DoH is if networks can just silently override the setting. You can explicitly configure the browser to insist on DoH whereupon it's your fault if that doesn't work. But the defaults changed only to try to do DoH if they can. "If a user has chosen to manually enable DoH, the signal from the network will be ignored and the user’s preference will be honored."

Well I have already manually disabled and enabled it a few times and it still clearly always uses the fallback. So if disabling fallback is a setting, it's something beyond manually turning DoH on in the preference panel.

Re: Chrome’s address bar will use https:// by default

#444

Post by forgotmypw17 »

isignal wrote: post #346
jussij wrote: post #332

Earlier quoted context omitted.

The OP means that in using https (and being forced to used https) you are also being forced into paying a 'third party' an annual fee just to get a valid certificate. That 'third party' is one of the recognized 'certificate authorities'. But the OPs point is by going https, you don't have a choice, you have to pay the certificate tax.

This is not true, you can set your host to trust a self signed certificate without much difficulty. Check out this tool for example https://github.com/FiloSottile/mkcert (prev discussion at https://news.ycombinator.com/item?id=17748208 )

How long do you think it would take someone who has never been to HN?

I don't think they would even know the option exists.

Re: Chrome’s address bar will use https:// by default

#445

Post by goldsteinq »

simias wrote: post #111

I wish there was a solution for those of us who develop web interfaces for embedded products designed to live on LAN, often without any internet access and no well defined domain name. I'm all for HTTPS everywhere but right now for my products it's either: https with self-signed certificate, which basically makes any modern browser tell its user that they're in a very imminent danger of violent death should they deci…

What if someone bought `httpslan.net`, issued a wildcard certificate for `*.httpslan.net` and published the private key?

Then anyone could just add `my.httpslan.net 192.168.0.13` to `/etc/hosts` and use published private key to verify connections?

It wouldn't be secure, as anyone could decrypt the connection, but for LAN it's not relevant, and it will make browser shut up.

Re: Chrome’s address bar will use https:// by default

#446

Post by zaarn »

tsimionescu wrote: post #406
zaarn wrote: post #331

Earlier quoted context omitted.

If you keep your CA secure, no reason that you can't set the expiration of the root cert to something like 10 years.

Will browsers accept that?

Browsers accept a root CA with long lifetime. Certs signed by CAs installed by the user or admin also allow long lifetimes (probably will still for a while).

Re: Chrome’s address bar will use https:// by default

#447

Post by zaarn »

xg15 wrote: post #361
zaarn wrote: post #333

Earlier quoted context omitted.

You can simply send a ICMP Rejected Message, which should direct your browser to immediately try any fallbacks or other hosts. Timeouts occur when you incorrectly configure your firewall to drop packets instead of rejecting.

True, that would work as well. Though I believe it's recommended as a best practice to simply drop packets as not to help port scanners.

I don't worry about port scanners. If your infrastructure becomes less secure because of a port scanner, it's not very well secured. Sending a REJECT is cheap, no DDoS opportunity and helps browsers and other apps fail over fast.

The recommended practise I've heard everywhere is that an ICMP REJECT provides no opportunities for an attacker they wouldn't have with 10 minutes extra time (modern port scanners can be set aggressive enough that REJECT or DROP doesn't matter if they have a known open port they can obtain an ACCEPT timeline from).

Re: Chrome’s address bar will use https:// by default

#449

Post by xg15 »

zaarn wrote: post #447
xg15 wrote: post #361

Earlier quoted context omitted.

True, that would work as well. Though I believe it's recommended as a best practice to simply drop packets as not to help port scanners.

I don't worry about port scanners. If your infrastructure becomes less secure because of a port scanner, it's not very well secured. Sending a REJECT is cheap, no DDoS opportunity and helps browsers and other apps fail over fast. The recommended practise I've heard everywhere is that an ICMP REJECT provides no opportunities for an attacker they wouldn't have with 10 minutes extra time (modern port scanners can be set…

Yeah, that absolutely makes sense - as I said, a site could also avoid the timeout by sending a TCP RST packet. My point was more that I believe not many sites are doing any of this as in the past, "best-practice" firewall configuration was to be as silent as possible.

Re: Chrome’s address bar will use https:// by default

#450

Post by Wowfunhappy »

throwaway53453 wrote: post #432
Wowfunhappy wrote: post #337

Earlier quoted context omitted.

> 3 months? I must have updated FireFox / Discord / VS Code /etc. I think this state of affairs is nuts. With the exception of Firefox, because web browsers have an inordinate number of security issues to contend with.

And other programs don't?

An instant messaging client shouldn’t be executing arbitrary remote code, no.
Post reply on HN