Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome 56 will mark HTTP pages with password fields as non-secure

security.googleblog.com

Post reply on HN
Print view View original

91–100 of 419 posts

Re: Chrome 56 will mark HTTP pages with password fields as non-secure

#91

Post by Piskvorrr »

tyingq wrote: post #75
pjc50 wrote: post #66

Earlier quoted context omitted.

I'm fairly sure that violates PCI-DSS.

I suspect PCI is okay with it so long as it is an unsecure page that posts to a secure one. Not that it's a great idea, but it would be encrypted in transit. Edit: It appears PCI DSS V3.2 does ask that the form itself be on a secure page (section 4.1.g): "for browser-based implementations: 'HTTPS' appears as the browser Universal Record Locator (URL) protocol, and Cardholder data is only requested if “HTTPS” appears…

Yeah, because MITMing the origin page to submit to evil.example.org is trivial.

Re: Chrome 56 will mark HTTP pages with password fields as non-secure

#92

Post by comex »

Moru wrote: post #76
kevin_thibedeau wrote: post #71

Earlier quoted context omitted.

Why would such a form need a password field?

Well, that is the whole point I'm trying to make. Why does chrome think I'm using a password on the page when there is no password? Anyway, Chrome will mark all http as insecure sooner or later so will just have to force https on all connections... There seems to be many people with similar problems of false positives for nonexistant passwords so I guess it's a bug.

I haven't heard of this bug, but regarding the decision to mark all HTTP as insecure:

Remember, HTTPS isn't just for security, but also privacy. And even if your site is such that there is no privacy advantage in hiding the exact URL you visited (as opposed to the hostname, which unfortunately must leak for now), even if there are no cookies sent to your site, or to any iframes it uses, which can be used for identification or profiling…

Even then, there are the benefits that only accrue if a user's entire browsing session is HTTP-free, including hiding the user agent from a network attacker and preventing injection of everything from tracking cookies to DDOS scripts (China's Great Cannon) to zero-day attacks.

Re: Chrome 56 will mark HTTP pages with password fields as non-secure

#93

Post by Piskvorrr »

nsgi wrote: post #63
meta_AU wrote: post #24

What should be done for routers and printers that are accessed by their IP address?

The best solution is for them to be accessed through a publicly registered hostname e.g. https://router0123.netgear.com (that would only resolve locally). They could provision certificates for themselves using the Let's Encrypt DNS challenge.

Now you're vulnerable to DNS hijacking.

Re: Chrome 56 will mark HTTP pages with password fields as non-secure

#94

Post by the_duke »

Moru wrote: post #76
kevin_thibedeau wrote: post #71

Earlier quoted context omitted.

Why would such a form need a password field?

Well, that is the whole point I'm trying to make. Why does chrome think I'm using a password on the page when there is no password? Anyway, Chrome will mark all http as insecure sooner or later so will just have to force https on all connections... There seems to be many people with similar problems of false positives for nonexistant passwords so I guess it's a bug.

I don't really know what your point is.

This will mark pages as insecure that have a '' field on your page. If you don't have that, you are fine.

I don't know of any reasons to have a password field if it's not actually sensitive information that's being entered.

Re: Chrome 56 will mark HTTP pages with password fields as non-secure

#95

Post by johndoe4589 »

lucideer wrote: post #4

Firefox has started to do this recently and it's been fantastically informative and helpful. It's the one new browser feature I never really considered wanting/needing before, that's really stood out to me as being incredibly valuable since I've started to see the warnings pop up.

Kinda like how your antivirus tells you about how the formidable threats it saved your ass from today?

Or like "did you know your house COULD have been ransacked today, but it didn't happen!!"

Now all my users are going to hear that my site is insecure, when nothing at all changed.

How long ago did they announce that? I think just a couple months? They should have announced this much sooner.

It's going to hit me hard as my site is pretty niche and driving even more people away is the last thing I hoped for :( My shared hosting doesn't offer Let's Encrypt, and makes me pay to "install" a free certificate anyway. So I have to move everything to a different web host.

Re: Chrome 56 will mark HTTP pages with password fields as non-secure

#96

Post by nsgi »

Piskvorrr wrote: post #93
nsgi wrote: post #63

Earlier quoted context omitted.

The best solution is for them to be accessed through a publicly registered hostname e.g. https://router0123.netgear.com (that would only resolve locally). They could provision certificates for themselves using the Let's Encrypt DNS challenge.

Now you're vulnerable to DNS hijacking.

HTTPS prevents that.

Re: Chrome 56 will mark HTTP pages with password fields as non-secure

#98

Post by michaelmior »

johndoe4589 wrote: post #95
lucideer wrote: post #4

Firefox has started to do this recently and it's been fantastically informative and helpful. It's the one new browser feature I never really considered wanting/needing before, that's really stood out to me as being incredibly valuable since I've started to see the warnings pop up.

Kinda like how your antivirus tells you about how the formidable threats it saved your ass from today? Or like "did you know your house COULD have been ransacked today, but it didn't happen!!" Now all my users are going to hear that my site is insecure, when nothing at all changed. How long ago did they announce that? I think just a couple months? They should have announced this much sooner. It's going to hit me hard…

It may not be an option for you, but you could consider using a free proxy service such as Cloudflare.

Re: Chrome 56 will mark HTTP pages with password fields as non-secure

#99

Post by the_duke »

johndoe4589 wrote: post #88
jakobdabo wrote: post #42

Earlier quoted context omitted.

The majority of the big sites that people use (Google, GMail, Youtube, Facebook, Reddit, NYT, WaPo, etc.) are already being served using HTTPS. I think if a couple of HTTP sites an average user still browses start showing these warnings they will notice them. And what matters, the owners of those websites will notice them and will ask their "IT guy" hey "why our website is marked as insecure? I want a green lock like…

Their IT guy?? There are gazillions of people like me who have a blog, or some small project that has a small audience of tens to just a few thousand users. All these people now have to fork for SSL, or have to move everything to a different shared hosting that supports Let's Encrypt.

Right now, you can just put Cloudfront in between. It's free, and takes maybe 5 minutes to sign up and adjust your DNS entries.

Of course relying on a provider that might cancel the free plan at any time is not ideal, but worst case you just have to revert your DNS and it's done.

Re: Chrome 56 will mark HTTP pages with password fields as non-secure

#100

Post by fdsaaf »

mappu wrote: post #38
brettz wrote: post #23

Earlier quoted context omitted.

So accurate. We had this exact discussion. Going to go with insecure warnings until we get https up shortly. For those wondering you can mask a normal text field in css input { -webkit-text-security: disc; }.

My colleague used a custom web font where every glyph was replaced with a filled circle. Better browser compatibility, you know. Although our reason was actually to do with password managers. At $DAYJOB we have a CRM/ERP system with lots of password fields for other entities (not the current cookie user). It's increasingly difficult to opt out of browser autofill, and LastPass in particular was corrupting password da…

> It's increasingly difficult to opt out of browser autofill

Good. I hope browsers autodetect these web font tricks and pop up similar warnings. I can't stand when some random website make thinks it can do a better job of credential security than major browser makers.

Post reply on HN