Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome’s address bar will use https:// by default

blog.chromium.org

Post reply on HN
Print view View original

81–90 of 463 posts

Re: Chrome’s address bar will use https:// by default

#81

Post by paxys »

reaperducer wrote: post #48

When the big push to HTTPS came around, I was all in favor of it. Now... I'm more skeptical. Not everything has to be HTTPS. And I've become aware that many of the sites I visit are HTTP only and will never become HTTPS because of their age, or the lack of technical ability of their owners. HTTPS also has the side effect of obsoleting older hardware for no real reason. I have devices that work perfectly fine, but can…

No browser does what you are saying. And I don't get what hardware age has got to do with anything?

The moment you use an ISP that injects its own ads into web pages you will realize that HTTPS is absolutely essential everywhere.

Re: Chrome’s address bar will use https:// by default

#82

Post by remram »

Ajedi32 wrote: post #20
pornel wrote: post #13

That makes a lot of sense. HTTPS adoption is now very high[1], and this might push it a little bit further for sites that don't redirect to HTTPS automatically. I've been using Firefox in the experimental HTTPS-only mode, and the web is quite usable without cleartext HTTP. [1] https://transparencyreport.google.com/https/overview It's not a big change from security perspective though. HTTP requests shouldn't be gettin…

It seems like this is primarily a performance optimization, at least for now. One less round trip when navigating to a site by typing the domain name when that site redirects to HTTPS (and isn't on the HSTS preload list).

It's a huge security improvement. The HTTP->HTTPS redirection is not secured in any way.

[edit: it's not really because it falls back]

Re: Chrome’s address bar will use https:// by default

#83

Post by asplake »

CodesInChaos wrote: post #45
asplake wrote: post #31

Potential source of frustration: naked domains on http that upgrade to https after redirect to www or some other subdomain. It’s a problem to me now - if I name my naked .org site in GMail it assumes https. At some point I will have to host my own redirection service, just for this one issue. Side note: it beats me why browsers couldn’t agree a way to specify at least the first redirect in DNS, no web server needed f…

You'd need to authenticate that redirect, so it isn't as easy as it looks. (something like DANE and DNSSEC) The benefit doesn't seem big to me. You're already running a http server for the original domain, and an https server for the target domain, so extending the http server for the original domain to https doesn't sound like a big step.

I'm using AWS Elastic Beanstalk, and you're not supposed to point a naked domain at the load balancer. On reflection though, it's a problem Amazon could solve there.

None of this is super hard but it is annoying, some complexity that feels removable.

Re: Chrome’s address bar will use https:// by default

#84

Post by marcosdumay »

banana_giraffe wrote: post #42
jefftk wrote: post #9

Earlier quoted context omitted.

"For sites that don’t yet support HTTPS, Chrome will fall back to HTTP when the HTTPS attempt fails." MITM is still an issue. At some point I hope browsers can switch to "you have to type http:// if you want HTTP", and this is a step in that direction. (Disclosure: I work for Google, speaking only for myself)

I'm curious if that includes falling back to HTTP when HTTPS has worked in the past. I only ask because I'm curious what this will do with captive portal nonsense.

It has been a long time since I've seen a captive portal that doesn't trigger the "this connection needs authentication" message on my phone.

Re: Chrome’s address bar will use https:// by default

#85

Post by reaperducer »

caymanjim wrote: post #63
reaperducer wrote: post #48

When the big push to HTTPS came around, I was all in favor of it. Now... I'm more skeptical. Not everything has to be HTTPS. And I've become aware that many of the sites I visit are HTTP only and will never become HTTPS because of their age, or the lack of technical ability of their owners. HTTPS also has the side effect of obsoleting older hardware for no real reason. I have devices that work perfectly fine, but can…

All Chrome does when you visit an http site right now is put a subtle white warning icon and the words "Not Secure" next to the location bar, in lieu of the lock icon you get with https. There are no blocks, no big red scary icons, no password requests. The content on the page renders identically to a secure page. Technology moves on, and encryption is important, even if there are some cases where it's not strictly v…

All Chrome does when you visit an http site right now is put a subtle white warning icon and the words "Not Secure" next to the location bar

That's great. But Chrome isn't the only browser in the world.

My point about browsers entirely blocking HTTP pages, putting up red scary icons and requiring a system password currently exists in Safari, both desktop and mobile.

Technology moves on

This is a lazy argument. And in my opinion, meaningless.

encryption is important

You are correct. But it is not required on every web site any more than everyone needs to carry a gun into a library to look up recipes.

Re: Chrome’s address bar will use https:// by default

#86

Post by paganel »

jefftk wrote: post #9
dfabulich wrote: post #4

There's no link to more technical detail. What happens when the site I type in the URL bar doesn't support HTTPS? Will it error out? (with a timeout?) Or will it automatically fallback to trying HTTP? (In that case, could a MITM block HTTPS to force the browser to try to downgrade?) EDIT: I see that the article says it will fall back, but Chrome Canary has options in chrome://flags, and it's not clear which option th…

"For sites that don’t yet support HTTPS, Chrome will fall back to HTTP when the HTTPS attempt fails." MITM is still an issue. At some point I hope browsers can switch to "you have to type http:// if you want HTTP", and this is a step in that direction. (Disclosure: I work for Google, speaking only for myself)

That is a stupid idea, forcing https on people’s throats is a stupid idea generally speaking but it wouldn’t have been that bad if it hadn’t been forced on many people by what is basically a monopoly by this point.

Re: Chrome’s address bar will use https:// by default

#87

Post by reaperducer »

paxys wrote: post #81
reaperducer wrote: post #48

When the big push to HTTPS came around, I was all in favor of it. Now... I'm more skeptical. Not everything has to be HTTPS. And I've become aware that many of the sites I visit are HTTP only and will never become HTTPS because of their age, or the lack of technical ability of their owners. HTTPS also has the side effect of obsoleting older hardware for no real reason. I have devices that work perfectly fine, but can…

No browser does what you are saying. And I don't get what hardware age has got to do with anything? The moment you use an ISP that injects its own ads into web pages you will realize that HTTPS is absolutely essential everywhere.

No browser does what you are saying

Safari has been doing this for at least two years.

And I don't get what hardware age has got to do with anything?

Not every browser gets upgraded to the latest HTTPS. There are millions of televisions, game consoles, older computers, and other devices that can only browse HTTP, or older versions of HTTPS. They will not be upgraded by their manufacturers. I don't think making those still capable devices less functional is a good idea just because "technology moves on."

Re: Chrome’s address bar will use https:// by default

#88

Post by ibejoeb »

ipsocannibal wrote: post #78
ibejoeb wrote: post #40

Earlier quoted context omitted.

It might still be an issue, but this is still a huge improvement. If the browser is going to pick a protocol on behalf of the user, it ought choose a stronger protocol first.

If the browser chooses the stronger protocol it should force the user to opt-in to any fallback behavior which might downgrade security. The current behavior of the browser in most cases is if you enter an 'https' url and the request fails or the cert is invalid you get a failure or warning message. I'd like to see this behavior kept in this case. It communicates what the browser is doing instead of silently downgrad…

That would be ideal

Re: Chrome’s address bar will use https:// by default

#89

Post by 0x0 »

OskarS wrote: post #61
bmicraft wrote: post #47

Earlier quoted context omitted.

What's the point in having the protocol spelled out when you have the lock icon anyways? I don't think this would be a useful default.

I agree! The protocol is not particularly interesting information, as long as it indicates secure vs. non-secure connection somehow. As long as it comes along when you copy the URL, it's fine. The bad version of this trend is when you hide the path after the domain like Safari does. That's awful design, that's a very relevant part of the URL!

It's quite annoying when the https:// prefix is hidden but then appears in copy-paste. Quite often I'd like to run things like "host -t mx " or "whois " and then it also copies the invisible "https://" prefix which is incorrect for these use cases.
Post reply on HN