10 ms·
Geolocation API removed from unsecured origins in Chrome 50
- Klathmon 10y agoAnd here's to hoping they are able to push for the same thing for getUserMedia and the device motion/accelerometer APIs as well!
- asherkin 10y agogetUserMedia was killed off for insecure origins quite a while ago in Chrome.
- Klathmon 10y agoOh shit really? That's awesome!
- randall 10y agoI think it was Chrome 48. It also doesn't work for localhost.
- Klathmon 10y agoLocalhost is considered secure context, so it should still work for that... It won't work with file:/// urls, but localhost is fine. At least it was for me in 49 a couple weeks ago.
- artursapek 10y agoIt would be pretty hard to use the API if you couldn't test your code on localhost :P
- nfriedly 10y agoI think you're mistaken about localhost, this works fine for me on localhost:3000 navigator.getUserMedia({ video: true, audio: true }, console.log.bind(console, 'success'), console.log.bind(console, 'error') ); Chrome v50.0.2661.94 (64-bit) on OS X
- r1ch 10y agoSo ad-supported sites have to choose between greatly reduced ad revenue or a broken app. Thanks Google.
- iLoch 10y agoTo the people replying to this comment, he's not talking about the ads not being able to use the users location. Most don't. But plenty of ad networks don't work properly or the CPM is much lower for HTTPS enabled websites. I'm guessing r1ch is using a users' locations for his site, and it's ad supported. Hope everyone who is against ads is willing to pay for their content from now on!
- r1ch 10y agoYes this was meant to be my point - I didn't even consider ads using gelocation (which explains the downvotes I guess :))). While we do use geolocation and ads on one of our sites, it's only a single page so this doesn't really affect us that much. I can see it causing big problems with ad-supported sites / services that use geolocation as a primary feature though as I've experienced first-hand the revenue drop that HTTPS causes.
- pdkl95 10y ago> he's not talking about the ads not being able to use the users location The reason for wanting the user's location doesn't matter. It's incredibly irresponsible to send the user's location (or any other user data) over the network unencrypted.
- Brakenshire 10y ago> So ad-supported sites have to choose between greatly reduced ad revenue or a broken app. Thanks Google. Geolocation API is pretty powerful. It's one thing for a random website to know approximate location, but to be able to track location within 10m is something else.
- ry_ry 10y agoPerhaps a gentler interim solution would have been to only allow accuracy to town/city level over http.
- TazeTSchnitzel 10y agoDoes this mean we'll have less ad-plastered sites immediately asking for geolocation the moment you visit them? Hooray!
- AnkhMorporkian 10y agoOr, alternatively, terrifically increased HTTPS-by-default rates.
- csulok 10y agoWouldn't Let's Encrypt offset any significant benefit of this change? Is it somehow difficult or counterproductive for these sites to add a certificate?
- dangrossman 10y agoGetting more sites to use Let's Encrypt, or Cloudflare, or to buy a certificate is the intended benefit of the change. Google is gradually restricting these APIs to encrypted origins in order to encourage sites to use encryption, not because they don't want the APIs used.
- tschuy 10y ago> to encourage sites to use encryption And because having your fine location cross the wire unencrypted is a terrible idea :)
- tard 10y ago> or Cloudflare https://www.cloudflare.com/ssl/#cloudflare-ssl-options https://www.cloudflare.com/ssl/#cloudflare-ssl-options cloudflare's "flexible ssl" option encrypts the connection between their datacenter and the user, but not the one between the datacenter and the actual web server i guess it's better than nothing if your host doesn't support ssl but the false sense of security could be harmful
- TazeTSchnitzel 10y ago
- _RPM 10y agowindow.navigator.geolocation.getCurrentPosition(function() { console.log(arguments); }) This shows me the coordinates and no Error is thrown. Chrome version: Version 50.0.2661.94 m
- ry_ry 10y agoFrom localhost? Because that's treated as safe in this case.
- deleted 10y ago[deleted]
- cpeterso 10y agoThe Firefox bug to restrict geolocation to secure origins is: https://bugzilla.mozilla.org/show_bug.cgi?id=1072859 https://bugzilla.mozilla.org/show_bug.cgi?id=1072859
- __jal 10y agoI'm very glad I don't touch web dev anymore. This piecemeal removal of features from one transport mode is exactly the sort of thing that causes clients (of the human, paying sort) to flip out when they misunderstand what is going on. Don't get me wrong - I think this is a good thing. And I don't know that the answer is a big, publicized drop of all these changes at once, although that would have certain advantages. But a trickle of dropped features that non-technical folks will never see announced is going to be a lot of fun for web developers.
- matthewmacleod 10y agoI don't really think the backlash is happening as you describe. There's quite a lot of public awareness about ongoing communications and privacy issues, and implementing SSL is extremely cheap in most cases. "We need to upgrade your security to keep things working, it will take a day" is a fairly straightforward sell in most cases.
- mtgx 10y agoSpeaking of which, whatever happened to the COWL system? I know Google & Mozilla were involved in researching the tech. Will it ever come to Chrome and other browsers? http://cowl.ws/ http://cowl.ws/ https://www.ucl.ac.uk/news/news-articles/1014/061014_COWL https://www.ucl.ac.uk/news/news-articles/1014/061014_COWL
- hughes 10y ago> It should not [affect development], localhost has been declared as “potentially secure” Glad this was included. Is https even meaningful when on a local server?
- 0x0 10y agoDoes this move really solve ANY privacy problem? Getting geolocation already prompts the user for approval. Any sinister party wouldn't bat an eye at setting up https. Odd.
- swyman 10y agoThe idea is that other parties on the network won't be able to snoop on the location data.
- dudus 10y agoThe concern is that if the site is insecure you might send Geolocation which might be sensible information through unsecure channels allowing someone to snoop on the connection and read that data. In other words they are trying to hide the geolocation data from proxies, Carriers, ISPs and someone possibly MitM attacks
- Etheryte 10y agoThis isn't a privacy problem, it's a security problem.
- jlhonora 10y agoAnd also from our experience, it seems that they're only allowing TLS 1.0 and up. https://github.com/alexreisner/geocoder/issues/1034 https://github.com/alexreisner/geocoder/issues/1034
- jimmaswell 10y agoSo now if someone who hosts/rents a small server for side projects/hosting small services like community forums or a simple game wants to make something experimenting with geolocation they'll have to buy an HTTPS cert, make an app (which requires paying for the ability to put apps on major app stores unless you want to only support Android, where the OS discourages users from installing 3rd party apps with messages about how they might harm your phone, or jailbroken iPhones), or only support non-Chrome browsers (as long as other browsers don't follow in this). Is it really a good thing to restrict web functionality even more from small players? How does it matter if someone sniffs your GPS location from an HTTP connection? Are there situations where that's feasible and your precise geographic location isn't something the attacker doesn't already know? The only major situation I'm aware of is wifi hotspots where the location is already known. Edit: Apparently there are free certificate suppliers, but will those be sustainable if HTTP is eventually fully phased out? Browsers display errors with self-signed certificates, so it still seems problematic in the long run to have to depend on the good graces of other parties if you want to serve web content.
- pfooti 10y agoI have a side-project server. It took me about fifteen minutes to get a ssl cert with letsencrypt, and it was free. I even get use it on my mumble, smtp and imap servers.
- gcr 10y agoAgreed. Letsencrypt has come very close to making SSL certificate generation a non-issue for small websites.
- SpaceManiac 10y agoPerhaps they are interested in defending against sniffing further along the line (ISP, backbone) or are just making the change as part of the general strategy to encourage HTTPS use? While I see your concern about inconveniencing smaller players, LetsEncrypt exists now, and there are definitely mid- and large-sized players that I would like to see pushed in the direction of HTTPS exclusivity.
- 10y ago