13 ms·
Chrome is warning users about insecure pages
- pyre 10y agoThe blog post is dated September 2, 2016, and it claims: > Today Chrome's stable channel was updated with a new HTTPS UI. But I remember noticing these changes at least a week ago if not longer. The Chrome Stable channel link he used supports me in this as it's dated July 20, 2016.
- lorenzhs 10y agoIn the next sentence, the article goes on "Chrome 53 for Windows, Mac users got them in Chrome 52" - could that explain the situation perhaps?
- pyre 10y agoIt's a little confusing that a sentence saying "today" links to a blog post from July.
- nailer 10y agoI originally posted it in July for the Mac changes, then updated it today when they hit on Windows. I've changed the link to the Windows 53 release.
- lorenzhs 10y agoYeah, I agree. For the record, I'm on Linux and I noticed the change yesterday. According to my package manager's log, I upgraded Chrome from 52 to 53 yesterday around 10am (8am UTC).
- oneeyedpigeon 10y agoI'm on Chrome 52 on Mac and I don't see the "i" icon when using plain http. All I see is a very plain looking 'blank page' icon to the left of the URL.
- pyre 10y agoIs it possible that an extension is interfering? My version number is: 52.0.2743.116 (64-bit)
- anonymousguy 10y agoHTTPS everywhere is nice... except if your current web host makes free HTTPS hard because they make money from selling certificates.
- ihuman 10y agoCouldn't you just use "Let's Encrypt" then, unless someone else is hosting the content for you?
- wastedhours 10y agoThink that's part of it - a substantial amount of the web is on shared hosting (and probably dictated by other areas of the business) and as such wont have any level of root access. Therefore the hosting company can control cert installation and thus cost.
- rando444 10y agoYou don't need root access. We run a cpanel server and have a let's encrypt plugin that allows users to generate and install their own certificates.
- wastedhours 10y agoUsually add-ons are administered by the hosting company though (?) - so if they want to own the cert purchase/installation flow, then they can certainly do that.
- chris_wot 10y agoDon't use a hosting company who does that. Take your money and spend it elsewhere.
- ubernostrum 10y agoThese hosting companies are already doing enough things "wrong" that if "well, everybody just stop using them" were going to be a viable strategy it would have worked by now for those other things. We currently do not have the power to change the behavior or the market share of these hosting companies in any significant way. That leaves working around their behavior as the option.
- fizzbatter 10y agoHmm, i have a bunch of static sites on custom domains through things like Github pages. Guess i need to get them figured out.
- Zombieball 10y agoI host my static sites out of S3 and use Route53 to manage my DNS. If you go this route, it's only a few clicks through a setup wizard to get an SSL cert and enable https.
- lorenzhs 10y agoI use CloudFlare with SSL (Full) for this. Not optimal, but according to a recent comment on HN (https://news.ycombinator.com/item?id=12389850 https://news.ycombinator.com/item?id=12389850) CloudFlare plan to offer "more granular origin certificate validation" in the future.
- JorgeGT 10y ago"Don't let the perfect be the enemy of the good". While not the optimal solution this route significantly increases security while at the same time being easy and free to setup. I hope that CF starts to validate github pages certs so we can switch to their "strict" option in the future.
- bobfunk 10y agoHave a look at Netlify (https://www.netlify.com https://www.netlify.com) - our free tier is like GitHub pages on steroids including HTTPS for custom domains (and deploy previews, use any build tool not just Jekyll, redirect rules, etc...).
- wodenokoto 10y agowhat do you mean when you say "not just jekyll"?
- leftnode 10y ago
- TempleOSV409 10y agoI'm in a prison. God put blood and sweat into TempleOS. I just have to wait. It's a sure thing. God says... Agatha's reevaluate earthworm's accreditation hooted heady vaccinates balanced fastness billow smock's colors leprosy Woodard Koran's rabbinate Oberlin's model's Baha'i tissue upstairs Osborn Zara's decode playwright Polaroids wit outstripped Bacardi rasher capacitors Izhevsk We will have 400 million users overnight when story of first contact is breached.
- kels 10y agoEV certs don't look as cool as they used to. The green they use is to close to black. I know Edge got rid of the green bar as well but the green they use stands out.
- nailer 10y agoAuthor here. It's a more accurate reflection of what EV offers: it's about matching identities to certificates, not 'selling green bars' the big CAs have been doing for years.
- deathanatos 10y agoI feel like I'm missing something here, as both you and the article heavily imply that Chrome displayed EV certs prior to 52. In my experience, Chrome hasn't displayed EVs; here's an EV cert site for me under Chrome 51: https://i.imgur.com/azKdzPd.png https://i.imgur.com/azKdzPd.png — this is the same presentation it gives DV certificates. (The same site in Firefox: https://i.imgur.com/yrtypBZ.png https://i.imgur.com/yrtypBZ.png )
- grahamedgecombe 10y agoChrome requires Certificate Transparency for the EV indicator to be displayed - see https://news.netcraft.com/archives/2015/08/24/thousands-short-changed-by-ev-certificates-that-dont-display-correctly-in-chrome.html https://news.netcraft.com/archives/2015/08/24/thousands-shor...
- pfg 10y agoHere's a screenshot of the EV UI prior to this change: https://ftt-uploads.s3.amazonaws.com/browser-ssl-ui-comparison.png https://ftt-uploads.s3.amazonaws.com/browser-ssl-ui-comparis... It's possible that some sort of corporate MitM proxy is replacing the certificate in your case, or it's CT-related, as mentioned in a sibling comment.
- deathanatos 10y agoI'd see a MitM in the cert chain if I manually inspect it, wouldn't I? (It'd be signed by the corporate MitM CA cert, right?) Interesting that it shows up in your screenshot though; BoA on both Chrome 51 (on OS X) and Chrome 51 on Linux doesn't display the EV for BoA, or GitHub. (I doubt the MitM one, since the Linux machine is my home one. The OS X one is my corp laptop, so corp MitM'ing is believable there.) or is the screenshot incredibly outdated, since it says Chrome 8, and CT came later?
- deleted 10y ago[deleted]
- deleted 10y ago[deleted]
- cjhanks 10y agoI find it sad that corporations have decided the internet should be predominantly a private space. Think of it, all of those brilliant http://c2.org http://c2.org wiki's and ASCII-doc sites are now marked "insecure". Fundamentally -- some wonderful scientists and engineers created a paradise of free exchange. Commercial enterprise introduced the concept of 'money'. A bunch of thieves robbed them. And so we all have to put up walls with locks on them.
- savanaly 10y agoIt's not just about money, right? Even if it was just scientists writing essays and sharing them with each other we would still need https to prevent, say, providers from snooping on or altering page contents.
- semi-extrinsic 10y agoSince I am the creator and maintainer of a scientific web app for molecular dynamics (shameless plug: http://www.bottledsaft.org http://www.bottledsaft.org) which is not on https (yet), I decided to check whether scientists browsing the net will quickly learn to ignore this warning. Finding so far: Yes, they will. No need to hurry, but I will go https eventually. Of the sites I checked quickly, these are running non-https by default: http://www.tandf.co.uk http://www.tandf.co.uk (Taylor & Francis, bunch of engineering journals) http://www.aps.org http://www.aps.org (American Physical Society, i.e. all the Phys. Rev. journals) http://journals.cambridge.org http://journals.cambridge.org (bunch of math and physics journals) http://www.thomsonreuters.com http://www.thomsonreuters.com (ManuscriptCentral, Scopus, the home of Impact Factor) http://www.sciencemag.org http://www.sciencemag.org (Science and other AIAA journals) http://www.nature.com http://www.nature.com (Nature Publishing Group) ... and I couldn't be bothered to check more
- jtruk 10y agoAs another data point, It's the same story for international web-tech conferences. Scatter sample: https://www.techdiary.co.uk/elsewhere https://www.techdiary.co.uk/elsewhere [1] [1] I run this, though only keep the NE section updated just now.
- rebelde 10y agoI really prefer to do what is best for my users: fast loading simple pages for users with slow connections on the other side of the world. (So, HTTP, not HTTPS.) But there is no sense fighting the powers that be. EDIT: Thanks for the down votes! Unpopular thoughts like mine should be discouraged. Groupthink is best!
- Walkman 10y agohttps://istlsfastyet.com/ https://istlsfastyet.com/
- lallysingh 10y agoOf note: TLS operational costs are still higher, right? Not necessarily. Once you enable and optimize your TLS stack you're also well on your way to deploying HTTP/2. Unlike HTTP/1.1, HTTP/2 requires only a single connection per origin, which means fewer sockets, memory buffers, TLS handshakes, and so on. As a result, it may well be the case that you will be able to handle more users with fewer resources.
- kuschku 10y agoThat applies to modern hardware and modern infrastructue – not to people in third world countries on decade old cheap hardware with barely working networks.
- Dylan16807 10y agoDecade old hardware can do TLS fine. Barely working networks can do TLS just as well as they can do non-TLS.
- kuschku 10y agoBarely working networks tend to use custom caching systems where TLS accesses often taken dozens of times longer.
- 10y ago
- bandrami 10y agoAs long as they treat an untrusted certificate as worse than plaintext (when in fact it's strictly better) this is all theater.
- legitster 10y agoIt's better not to pretend to establish trust than establish a fake trust.
- bandrami 10y agoNegative. If I'm being phished by organized crime, I'd still rather the NSA not also be able to listen in. The blinkard refusal of parts of the security community to understand this is appalling. An untrusted certificate means I know I am communicating with one and exactly one agent, whose identity I may later negotiate by other means.
- msbarnett 10y ago> The blinkard refusal of parts of the security community to understand this is appalling. An untrusted certificate means I know I am communicating with one and exactly one agent, whose identity I may later negotiate by other means. All you're doing, then, is attempting to replace a heavily vetted, non-MITMable identity-verification scheme with your own ad-hoc version of the same, and what the security community understands is that you're incredibly likely to fuck this up in a way that makes it trivial for your attacker to forge their identity.
- woliveirajr 10y agoWill this warning catch insecure pages which URL (or URI for pedantics, whatever suits) begin with https://google.com/amp/.. https://google.com/amp/... ? [1] [1] https://news.ycombinator.com/item?id=12395092 https://news.ycombinator.com/item?id=12395092
- rpiwetz 10y agoAfter updating Chrome, I visit google.com and see the gray i due to "a weak security configuration". If users are seeing this gray i everywhere, it will just be ignored, right?
- oneeyedpigeon 10y agoYou're going to http://www.google.com http://www.google.com? Is that even possible? Can you post the full final URL that you are actually viewing?
- nailer 10y agoCorporate office with a MITM proxy? Could be worth looking at who signed the cert.
- Jordrok 10y agoTo be honest, I didn't even realize that the grey 'i' was supposed to be a warning. I'm so used to seeing the little "blank document" icon there that my eyes totally glossed over it. I doubt many people are even going to notice the change, let alone worry about what it means. It's even worse in incognito mode now where the little padlock icon and "https" are both plain white, exactly the same color as the main URL. To a cursory glance, secure and non-secure both look very similar.
- newjersey 10y agoIs there a good reason why squarespace can't enable https at least for those who "buy" their domain names from squarespace as well? It shouldn't cost squarespace any significant amount of money, should it? And yet https://support.squarespace.com/hc/en-us/articles/205815898-Does-Squarespace-support-SSL-access- https://support.squarespace.com/hc/en-us/articles/205815898-...
- blowski 10y agoDepends on how they've built their stack. At a guess I'd say if it was easy for them to do it, they would already have done it - at least offering it as a premium upgrade.
- newjersey 10y agoIf they're both the host and the domain registrar, couldn't they simply point dns to a different set of servers where they host the https keys and then send traffic to the real server which hosts the websites? Is it a performance issue? Even amazon.com serves over https now...
- blowski 10y agoI have no idea why they haven't done it, and agree that for some stacks it would be easy. But there are some stacks where it would be really difficult because of small details.
- nailer 10y agoMy understanding (I talked to them about it a year ago) was they have to do some work on making a big SNI-based load balancer that works with their current network setup.
- elithrar 10y agoPlus: lazy loading certs and the appropriate key management infrastructure to support it.
- eatbitseveryday 10y agoTim Berners-Lee has an article titled 'Web Security - "HTTPS Everywhere" harmful'[1]. He argues not that encryption is bad (as the title might ambiguously suggest), but that the use of a different URI prefix (http vs https) is harmful because it requires use of that prefix to ensure encryption and authentication is used. Rather, the HTTP prefix should be used for encryption, and upgraded in real-time by the client. > A proposal then is to do HTTPS everywhere in the sense of the protocol but not the URI prefix. A browser gives the secure-looking user interface message, such as displaying the server certificate holder name above the document, only when the document has been fetched in an authenticated over an encrypted channel. This can be done by upgrading the HTTP to include TLS in real time, or in future cases by just trying encrypted version first. He also states > It is the user's task to ensure that their interactions are secure. meaning, users are trained to look for the 's' but browsers are hiding the URI prefix, making this difficult. [1] https://www.w3.org/DesignIssues/Security-NotTheS.html https://www.w3.org/DesignIssues/Security-NotTheS.html
- hannob 10y agoThis pops up every time. I don't really get what he's trying to tell us here. If we forward HTTP requests to HTTPS and use HSTS on top we're basically doing what he wants, right?
- pdpi 10y agoAs I understand it, he's suggesting that HTTP should incorporate something equivalent to STARTTLS as seen in some form in IMAP, POP3, FTP, LDAP, Postgres, and probably several others I'm forgrttingg
- marcosdumay 10y agoWell, that gave really bad results in SMTP IMAP, POP3, and LDAP. Postgres just does not suffer much because the client always knows wether to upgrade the connection or not. Ideally, we should be using DANE or some other kind of signed broadcasted info. Telling the user what happened is just a very good workaround (that will stay useful even if we change to DANE).
- jeffehobbs 10y agoArticle by "Mike MacCana, founder at CertSimple.". So, grain of salt.
- nailer 10y agoMike here. You can easily verify the current behavior by installing Chrome 53 on Windows or 52 on Mac. Everything else is (eg, https://www.chromium.org/Home/chromium-security/marking-http-as-non-secure https://www.chromium.org/Home/chromium-security/marking-http...) is directly linked in the post. There's nothing you can't easily verify.
- JadeNB 10y agoI think that jeffehobbs is suggesting that your call to action, rather than the facts on which it is based, should be viewed with extra scrutiny because of your affiliation.
- dk8996 10y agoI love what Amazon did with ACM, free certificates that are really easy to set-up but they don't support EV yet.
- cpeterso 10y agoFirefox already adds an (i) icon (with a "Connection is Not Secure" note in the popup) for all http:// http:// pages plus a red icon for http:// http:// pages with a password field.
- davegoehrig 10y agoAnd I now refuse to support Chrome in all my apps and sites.
- deadbunny 10y agoSomething about cutting off your nose...
- davegoehrig 10y agoI for one now refuse to support Chrome on all of my apps and sites. Their browser is broken by design, and is working against a free and open web.
- JoshTriplett 10y agoWorking towards making all connections secure is "working against a free and open web"? Insecure HTTP is "a free and open web"? I for one look forward to insecure HTTP becoming extinct.
- kbd 10y agoIn addition to what JoshTriplett said, good luck ignoring the browser with >50% market share: https://www.netmarketshare.com/browser-market-share.aspx?qprid=0&qpcustomd=0 https://www.netmarketshare.com/browser-market-share.aspx?qpr... https://www.netmarketshare.com/browser-market-share.aspx?qprid=0&qpcustomd=1 https://www.netmarketshare.com/browser-market-share.aspx?qpr...
- jalada 10y agoThe article mentions free DV certs from Heroku alongside offerings from Let’s Encrypt and CloudFlare. But Heroku don’t offer certificates for your domain like LE / CloudFlare, only ones for *.herokuapp.com. You have to obtain a certificate yourself.
- JBiserkov 10y agoI was delighted to find "Let's Encrypt SSL" in my cPanel. Tip: Select example.com and www.example.com and press 'Issue Multiple' to get 1 certificate that covers both!
- vizitas 10y agoWorth migrating to HTTPS soon then. There's a couple tools here to help make sure you don't end up with HTTPS mixed content issues: https://httpschecker.net/ https://httpschecker.net/ (Desktop & online.)
- chris_wot 10y agoAnyone know wh wildcard SSL Certs only work on the first level of domain names? Case in point - http://www.pinterest.onelogin.com http://www.pinterest.onelogin.com
- gnosek 10y agoAll of them, AFAIK. I think it's been like that since more or less IE7 days.
- chris_wot 10y agoYes, but why?
- PaulBurke 10y agoIt is limitation of Wildcard SSL Certificate which is decided by Certificate authority. So a wildcard ssl can only secure the first level domain. To secure second level suv-domains, you need to buy ssl for "*.first-level.website.com".
- tomjen3 10y agoHave lets encrypt committed themselves to issuing any valid certificate for any site and never canceling it based on them not liking the content? I don't want a future where we need companies permissions to post on the internet. Especially not political stuff.
- pfg 10y agoThat's a fight you'll have to take up with various root programs and the CA/B Forum. There are provisions that allow root program operators such as Microsoft to force Let's Encrypt to revoke certificate, though as far as I'm aware this should be limited to domains hosting phishing sites or malware. I'd argue Let's Encrypt's policy is as good as it can be while still following the policies required for root inclusion. Here's a relevant blog post[1]. [1]: https://letsencrypt.org/2015/10/29/phishing-and-malware.html https://letsencrypt.org/2015/10/29/phishing-and-malware.html
- technion 10y agoWell this got me reading about CertSimple. Never requires a lawyer or an accountant to fill in paperwork. I have a lot of hate for the whole concept of EV. Not only because it's theatre, but because I have to involve my accountant, and my legal team every time I buy one from Comodo. It's like pulling teeth. I'm going to give your team a try.