Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome will mark all HTTP sites as ‘not secure’ starting in July

theverge.com

Post reply on HN
Print view View original

51–60 of 143 posts

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#51

Post by sp332 »

jessaustin wrote: post #29
aequitas wrote: post #23

Earlier quoted context omitted.

This change will only add the grey 'not secure' text to the address bar and not hinder functionality. So it is just less green and not more red as with invalid or self-signed certificates where you have to perform additional steps to continue.

That's in this version. How many versions until we get the ridiculous harassment already required for self-signed certs?

The older blogpost that laid out the roadmap stops here. https://security.googleblog.com/2016/09/moving-towards-more-... It's not impossible that they would do that in the future, but their plans so far don't seem to include that.

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#53

Post by meta_AU »

xienze wrote: post #46
meta_AU wrote: post #43

Earlier quoted context omitted.

The other option is to register a domain and use that to get either LetsEncrypt cetts or purchase a wildcard.

That’s what I do. And LE actually supports wildcards, so that’s no problem. If your local network is firewalled off LE can still issue you a cert so long as you use DNS record validation.

It depends how often you want to update things I guess. A wildcard costs less than $50 a year these days, so if that might be better for some people than renewing their LE every few months.

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#54

Post by stefan_ »

tialaramex wrote: post #47
stefan_ wrote: post #5

So, what is the Chromes team solution for local network devices like routers? Proxy it over the manufacturers server for a complete loss of any privacy and security, but hey, there is a green check mark then?

The problem is really _naming_ these devices first of all. If they have (global) names there's no problem to issue a certificate for those names. But so often the device doesn't have any name at all, so it's maybe 10.0.0.1, and so is everything else, the problem only appears to be in the security layer because that's the first place which absolutely insists that you can't have a situation where everybody is just name…

That assumes your DNS is running through the device itself. For a router, maybe, beyond that, not really.

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#55

Post by zokier »

projct wrote: post #35
zokier wrote: post #19

Earlier quoted context omitted.

I don't know why there is still no standardization for advertising/providing CA services for local networks. How difficult would it be to just put local ACME endpoint to DHCP options?

adding a local CA means you can middleman anything you want to, seems like something that should be difficult to do, to me.

Name constraints are a thing. Local CA should be constrained to signing only local names (roughly matching dhcp domain-name/domain-search options).

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#56

Post by tialaramex »

meta_AU wrote: post #53
xienze wrote: post #46

Earlier quoted context omitted.

That’s what I do. And LE actually supports wildcards, so that’s no problem. If your local network is firewalled off LE can still issue you a cert so long as you use DNS record validation.

It depends how often you want to update things I guess. A wildcard costs less than $50 a year these days, so if that might be better for some people than renewing their LE every few months.

I almost sympathize but

1. Maximum cert lifetimes are falling, once upon a time you'd just pony up the cash and get five years. A year ago it was 36 months, for a few months now it's been 825 days, and there is downward pressure. So you are still going to need to renew this cert, and that means...

2. You can and should automate. Imagine buying a device in 2018 that expects you to manually input an IP address because "Eh, we could do DHCP but this was less effort (for us)". That'd be crazy right? Time to feel the same way about certificate automation.

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#57

Post by Buetol »

wildpeaks wrote: post #7

If you wonder how to get HTTPS for your local virtual hosts: 1. create a local CA 2. create a certificate using that local CA 3. Then you can add the CA in your trusted authorities (Firefox does need an extra step: either enable the "security.enterprise_roots.enabled" flag, either import the CA certificate manually in it). Details at: https://gist.github.com/cecilemuller/9492b848eb8fe46d462abeb...

Let’s push for self-signed certicates everywhere ! Let’s do Trust On First Use like SSH and now we’re done with all this certificates authorities bloated bureaucraties

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#58

Post by prepend »

zokier wrote: post #19
stefan_ wrote: post #5

So, what is the Chromes team solution for local network devices like routers? Proxy it over the manufacturers server for a complete loss of any privacy and security, but hey, there is a green check mark then?

I don't know why there is still no standardization for advertising/providing CA services for local networks. How difficult would it be to just put local ACME endpoint to DHCP options?

But then what’s the point? How is it more secure to have anyone get a server cert automatically without credentialing. Not to mention training users to trust all the BS local CAs popping up now that can then MITM traffic.

As a user, I don’t want local networks setting me up to make me recognize their CA services.

At first I liked SSL everywhere, but now I’m seeing a lot of hacks that are going to make SSL less useful.

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#59

Post by tvmalsv »

wildpeaks wrote: post #7

If you wonder how to get HTTPS for your local virtual hosts: 1. create a local CA 2. create a certificate using that local CA 3. Then you can add the CA in your trusted authorities (Firefox does need an extra step: either enable the "security.enterprise_roots.enabled" flag, either import the CA certificate manually in it). Details at: https://gist.github.com/cecilemuller/9492b848eb8fe46d462abeb...

Thank you! This, along with my sibling replies, is some great information. Nothing that most of us couldn't accomplish without it, but it's going to save a lot of time. Multiplied by all the others that find it useful (I can't be the only one, right?), you have saved a LOT of time :)

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#60

Post by rileymat2 »

Buetol wrote: post #57
wildpeaks wrote: post #7

If you wonder how to get HTTPS for your local virtual hosts: 1. create a local CA 2. create a certificate using that local CA 3. Then you can add the CA in your trusted authorities (Firefox does need an extra step: either enable the "security.enterprise_roots.enabled" flag, either import the CA certificate manually in it). Details at: https://gist.github.com/cecilemuller/9492b848eb8fe46d462abeb...

Let’s push for self-signed certicates everywhere ! Let’s do Trust On First Use like SSH and now we’re done with all this certificates authorities bloated bureaucraties

But how am I supposed to know if I can trust it if it is the first time I am using it?
Post reply on HN