Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome’s address bar will use https:// by default

blog.chromium.org

Post reply on HN
Print view View original

91–100 of 463 posts

Re: Chrome’s address bar will use https:// by default

#91

Post by parliament32 »

random5634 wrote: post #79
hannob wrote: post #60

Earlier quoted context omitted.

> The biggest problem I'm having is that our edge firewall doesn't play nicely with it for some reason.[...] I'm not entirely sure how it's working, but I seen a few other people with these issues at the mozilla bug tracker and it's always just sort of either ignored or dismissed. This sounds like you have some expensive enterprise equipment that is doing funny things with your TLS connection, but instead of complain…

Huh? If everything but one browser works, the suggestion will be to avoid using that browser unless you can show the expensive equip is doing something wrong. So firefox doing nothing more than a connection reset message does not help at all. A trouble ticket that says chrome works, wget works, curl works, IE works, but my firefox browser with 10 privacy plugins does not work - is NOT going to get a good response fro…

So, it sounds like FF is sending something that's causing an RST to be emitted from either the website or (more likely) your appliance. Next step would be to pcap/tcpdump a connection from both a working browser and FF, and see what the difference is. That kind of information is a lot more useful to FF devs than "something is happening that causes an RST from someone".

Re: Chrome’s address bar will use https:// by default

#92

Post by remram »

banana_giraffe wrote: post #42
jefftk wrote: post #9

Earlier quoted context omitted.

"For sites that don’t yet support HTTPS, Chrome will fall back to HTTP when the HTTPS attempt fails." MITM is still an issue. At some point I hope browsers can switch to "you have to type http:// if you want HTTP", and this is a step in that direction. (Disclosure: I work for Google, speaking only for myself)

I'm curious if that includes falling back to HTTP when HTTPS has worked in the past. I only ask because I'm curious what this will do with captive portal nonsense.

HSTS takes care of that. It's an HTTP header to indicate not to connect without TLS in the future.

It makes sense to keep falling back to HTTP if that header is not set.

Re: Chrome’s address bar will use https:// by default

#93

Post by ipsocannibal »

jefftk wrote: post #70
jeswin wrote: post #46

Earlier quoted context omitted.

> "you have to type http:// if you want HTTP" That makes sense only to programmers, who make a small fraction of users. Browsers are mainstream; we need to be more thoughtful.

Long term, to normal users, there should be only HTTPS.

Its a shame but I wish the insecure protocol name was not a prefix of the secure protocol name. Its so easy to miss the 's' and for things to just work for the wrong reason. I guess we have Netscape and Microsoft to blame for this one.

https://en.m.wikipedia.org/wiki/Secure_Hypertext_Transfer_Pr...

Re: Chrome’s address bar will use https:// by default

#94

Post by est31 »

remram wrote: post #82
Ajedi32 wrote: post #20

Earlier quoted context omitted.

It seems like this is primarily a performance optimization, at least for now. One less round trip when navigating to a site by typing the domain name when that site redirects to HTTPS (and isn't on the HSTS preload list).

It's a huge security improvement. The HTTP->HTTPS redirection is not secured in any way. [edit: it's not really because it falls back]

The info "is https available" is not secured either. The ISP can just block any packet on port 443 and force http that way. It would break links but wouldn't break people entering the address via the URL bar.

A real improvement in security would be Google caching the data, and either offering it via a custom API or just signing it and appending it to their 8.8.8.8 DNS responses. Per default, Chrome already sends the URL to Google as you type, you have to turn auto complete off if you don't want it to happen.

Re: Chrome’s address bar will use https:// by default

#98

Post by marcosdumay »

flotzam wrote: post #28

Is there a way to get exactly this new Chrome address bar behavior in Firefox? I.e. I want Firefox to follow plain http links same as before, but if I type in example.com it should expand to https://example.com

AFAIK, Firefox has worked exactly like this for a long time. There is probably some way to disable that behavior, and when you type a site, it offers an http suggestion for you to reach easily, but the default is https.

Re: Chrome’s address bar will use https:// by default

#99

Post by paxys »

reaperducer wrote: post #87
paxys wrote: post #81

Earlier quoted context omitted.

No browser does what you are saying. And I don't get what hardware age has got to do with anything? The moment you use an ISP that injects its own ads into web pages you will realize that HTTPS is absolutely essential everywhere.

No browser does what you are saying Safari has been doing this for at least two years. And I don't get what hardware age has got to do with anything? Not every browser gets upgraded to the latest HTTPS. There are millions of televisions, game consoles, older computers, and other devices that can only browse HTTP, or older versions of HTTPS. They will not be upgraded by their manufacturers. I don't think making those…

I just tried many http websites on Safari and am still not sure what you are talking about. They all work perfectly fine, without any warnings.

> Not every browser gets upgraded to the latest HTTPS

The solution to that isn't to compromise on security and privacy but rather make these devices upgradable/moddable.

Re: Chrome’s address bar will use https:// by default

#100

Post by remram »

paxys wrote: post #81
reaperducer wrote: post #48

When the big push to HTTPS came around, I was all in favor of it. Now... I'm more skeptical. Not everything has to be HTTPS. And I've become aware that many of the sites I visit are HTTP only and will never become HTTPS because of their age, or the lack of technical ability of their owners. HTTPS also has the side effect of obsoleting older hardware for no real reason. I have devices that work perfectly fine, but can…

No browser does what you are saying. And I don't get what hardware age has got to do with anything? The moment you use an ISP that injects its own ads into web pages you will realize that HTTPS is absolutely essential everywhere.

The point I think is that HTTP never changes, while HTTPS constantly evolves and deprecates hash functions, ciphers, and authorities. If your router's or printer's web management interface was written more than a couple of years ago, it is probable that it will show up as insecure or even have a big warning screen.
Post reply on HN