Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome will mark all HTTP sites as ‘not secure’ starting in July

theverge.com

Post reply on HN
Print view View original

71–80 of 143 posts

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#71

Post by Karunamon »

prepend wrote: post #58
zokier wrote: post #19

Earlier quoted context omitted.

I don't know why there is still no standardization for advertising/providing CA services for local networks. How difficult would it be to just put local ACME endpoint to DHCP options?

But then what’s the point? How is it more secure to have anyone get a server cert automatically without credentialing. Not to mention training users to trust all the BS local CAs popping up now that can then MITM traffic. As a user, I don’t want local networks setting me up to make me recognize their CA services. At first I liked SSL everywhere, but now I’m seeing a lot of hacks that are going to make SSL less useful…

Not to mention training users to trust all the BS local CAs popping up now that can then MITM traffic.

You say that as if users don't already mindlessly dismiss most warnings already. I'm not convinced this would be that big of a difference from the current system.

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#72

Post by [deleted] »

Buetol wrote: post #66
rileymat2 wrote: post #60

Earlier quoted context omitted.

But how am I supposed to know if I can trust it if it is the first time I am using it?

I trust more my first time connection to a website than so random authority a random country signing it, it’s that simple. But the money grab is so big that they keep existing ! EDIT: And you’re saying the SSH model is broken then. Also you can verify the certificate signature via another channel, like a git repo of all the signatures of most important websites (I know, it look like a CA)

[deleted]

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#73

Post by Nadya »

bowlich wrote: post #8

Because my statically generated blog really needs https. This is really going to create an additional layer of inconvenience for people who just want to drop some html documents in an ftp folder and be done with it.

>Because my statically generated blog really needs https.

So I was reading your blog and am particularly concerned about the crypto miner present on the page. Care to explain this to me? Hint: MITM due to insecure context and the miner isn't coming from you but as a user, I'm going to blame you because it happens on your insecure blog page.

Both my personal static site and my "literally only I can use it I've disabled user registration" file host use https. I can think of no good reason not to - to which people always link me that stupid anti-https n-gate article. The same site where the owner links to a Patreon account that I cannot verify is them and not a malicious actor looking to get donations from readers of the site. They also link to a Twitter account that may or may not be them.

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#74

Post by yjftsjthsd-h »

rileymat2 wrote: post #60
Buetol wrote: post #57

Earlier quoted context omitted.

Let’s push for self-signed certicates everywhere ! Let’s do Trust On First Use like SSH and now we’re done with all this certificates authorities bloated bureaucraties

But how am I supposed to know if I can trust it if it is the first time I am using it?

DNS? It works for SSH fingerprints. Random example: https://matoski.com/article/sshfp-dns-records/

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#75

Post by jononor »

craftyguy wrote: post #68
ktsmith wrote: post #17

Earlier quoted context omitted.

Most consumer routers use self signed certificates which will be marked as insecure by the browser.

All modern browsers allow you to import certs into their trust store.

But the UIs for that is actively discouraging people from doing so.

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#76

Post by dragonwriter »

jcoffland wrote: post #28

I wish Chrome would make an exception for pages on localhost and devices on the local network. There are currently no good solutions for acquiring certificates in these cases.

They aren't using the “faulty TLS” block page that requires work to get around, just an address bar “not secure” message.

If you are using localhost (or other HTTP instead of HTTPS site intentionally, it's not going to cause any problems.)

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#78

Post by Klathmon »

yjftsjthsd-h wrote: post #74
rileymat2 wrote: post #60

Earlier quoted context omitted.

But how am I supposed to know if I can trust it if it is the first time I am using it?

DNS? It works for SSH fingerprints. Random example: https://matoski.com/article/sshfp-dns-records/

doesn't that just push the "authority" to DNS. You still need someone to vouch that you are who you say you are.

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#79

Post by echevil »

wildpeaks wrote: post #7

If you wonder how to get HTTPS for your local virtual hosts: 1. create a local CA 2. create a certificate using that local CA 3. Then you can add the CA in your trusted authorities (Firefox does need an extra step: either enable the "security.enterprise_roots.enabled" flag, either import the CA certificate manually in it). Details at: https://gist.github.com/cecilemuller/9492b848eb8fe46d462abeb...

I'd expect Chrome to provide some settings at least to not mark local IPs as not secure

Re: Chrome will mark all HTTP sites as ‘not secure’ starting in July

#80

Post by deathanatos »

detaro wrote: post #70
zokier wrote: post #55

Earlier quoted context omitted.

Name constraints are a thing. Local CA should be constrained to signing only local names (roughly matching dhcp domain-name/domain-search options).

Name constraints are not universally supported in browsers sadly.

And this should be fixed. Name constraints would be incredibly useful for a number of things, if only they were supported.
Post reply on HN