6 ms·
Chrome 55 to start highlighting Not Secure websites
- jbb555 10y agoStill not changing my websites to https. They don't need to be "secure", they are not going to be "secure". I consider this a broken stupid change.
- Aaron1011 10y agoWhy? Without HTTPS, anyone between a user and your server can modify your page, without you noticing.
- madeofpalk 10y agoThere are certain types of sites where that doesn't really matter. My personal blog, for instance, I don't see the need for HTTPS there. In saying that, HTTPS is easier than ever to deploy to a website. This will only increase adoption of 'secure by default'
- Symbiote 10y agoPeople modifying your page can include ISPs injecting ads or reducing the resolution of images to save bandwidth.
- userbinator 10y agoI'm not the parent, but I say "let them".
- andybak 10y agoHow about injecting malware?
- Klathmon 10y agoAnd this isn't a "it could happen some day" threat, it's already a thing. There are simple one-click setup programs that can monitor a wifi network, and inject malware into any downloads of executable or zip files that it can find. With things like Stagefright still affecting a scary large amount of android users, what happens when someone starts injecting malware into images which can compromise an entire phone without so much as a hiccup.
- crottypeter 10y agoWhat if they inject hate speech / child porn / <any illegal content> and tell the authorities on you?
- userbinator 10y agoLike I said, "let them". The authorities will see nothing wrong with the content on the server, and look somewhere else. What happens "in transport" is absolutely not my responsibility. It could even serve as a sort of plausible deniability...
- throwaway6845 10y agoWhich has long been my suspicion why Google is so keen on promoting HTTPS. If all sites are HTTPS, Google kills ISPs' ability to inject ads and to profile customers. Not through any sense of altruism, but because Google is only interested in one megacorp being able to sell ads and track browsing: Google. It's good business for Google, but let's not pretend it's about "making the web better". It's about keeping commerce on the web as a Google monoculture.
- swiley 10y ago@symbiote I'm also unwilling to switch to https. If your ISP is attacking you then you should be tunneling things. I personally like the image compression and caching that they do and think it's somewhat important for my site and others like it.
- witty_username 10y agoSomeone could modify a link in your blog to go to malware. Example: "Hi guys, I like software X, download it here"
- xylon 10y agoMe too. Google can do what they want but they don't own the Internet.
- castell 10y agoI am with you. In many use cases HTTP 1 is fine. And as we have seen with the Hearthbleed bug, if you cannot devote resources to keep your HTTPS up-to-date all the time 24x7, it makes your server and the user sessions more insecure. And often providing HTTP and HTTPS makes sense too. So I am against labeling HTTP as "evil" or legacy. We should look who has an interest in doing just that, and why they are forming initiatives. Beside all that pretty much all ad-networks serve HTTP ads, so if you want to loose much of your ad revenue, please go with the HTTPS-only route and face the real world surprise.
- andybak 10y agoJust downloaded Canary. I'm not seeing it. I get the green secure on https but I don't see the red on any http sites. Anyone else?
- andygambles 10y agoAs per an earlier comment option to enable this feature is here: chrome://flags/#mark-non-secure-as Occasionally in a build it flips on then another build off.
- Ambroos 10y agoNot by default. When leaving chrome://flags/#mark-non-secure-as on "default", even in Chrome 55, non-secure sites are just neutral and don't have any specific non-secure indication. This flag has been available for a long time, since at least December 2014. The visual has been updated slightly in 54 or 55 (secure sites do now get the "Secure" badge instead of just a green lock). There is no change in default behaviour though. From time to time Canary changes the default to mark non-secure sites as non-secure, but it's always been rolled back very quickly. It's coming, but probably not very soon. A story like this makes tech news from time to time. In January this year a lot of sites posted about it, and when the flag was introduced late 2014 many of them did too. As long as there's no announcement from Google or the Chromium team (and there would be), nothing is changing.
- nailer 10y agoYou're correct: this is hidden behind a flag that's not currently enabled. The behavior in Chrome 55 (and also 53, the current stable) is the (i) indicator. Clicking on it tells you the website "isn't private": https://certsimple.com/images/blog/american-apparel-insecure.png https://certsimple.com/images/blog/american-apparel-insecure... However Google do intend to mark HTTP as non secure: for indications of future plans, best place to go is directly to the source: see 'Marking HTTP As Non-Secure' https://www.chromium.org/Home/chromium-security/marking-http-as-non-secure https://www.chromium.org/Home/chromium-security/marking-http... Note: I work at CertSimple.
- theandrewbailey 10y agoHonestly, I've been waiting for the "http = scary red error" change to happen for a while, so I can encourage my company's e-commerce clients to go 100% HTTPS only.
- wallunit 10y agoI never got, in the first place, why browsers show a big fat warning when accessing a properly encrypted website where the certificate can just not be verified, while a completely unencrypted website on the other hand looks just legit in the address bar.
- LoSboccacc 10y agobecause the whole thing lives off trust. if any certificate could be self signed for getting the browser trust, all MITM attack would go unnoticed unless the browser is pinning the hash of specific domains. that's why it's so important to blacklist fast certificate authority that do no domain ownership validation; it's a frail system, but it's the best we got for now.
- wallunit 10y agoNot that this is the same situation with unencrypted websites anyways.
- LoSboccacc 10y agoYeah but for encrypted websites you need to trust the certificate. Parent wasn't talking ss vs plain, but ss vs ca. If a self signed google.com would be accepted by firefox, it'd be much much worse. You'd thought is secure and instead it may not be. The system we have isn't flawless, but it beats having to pin down every signature manually if browsers started treating self signed as trusted
- pdkl95 10y agoSo you prefer plaintext, which is even easier to MITM? These MITM attacks go unnoticed every day. Logging self signed certificates at least gives us a chance at detecting a MITM. All of your concerns require an assumption that the browser uses unauthenticated encryption the same as PKI authenticated. Please stop conflating encryption with authentication; they solve different problems. This attitude that a partial solutions should be actively discouraged is why the internet is still uses plaintext which should have been dropped years ago.
- userbinator 10y agoOne of my biggest concerns is that the many "Not Secure" websites out there, likely older ones, will get ostracised as a result of this type of change. I don't think that's necessarily a good thing, because that's where I've found the most informative and interesting content. You can imagine in the future, users coming across some site that actually has good information, but being scared away by the "Not Secure" and instead going to some vapid ad-filled "modern" site with very little in the way of detailed content, just because it happens to be using HTTPS.
- Jaruzel 10y agoI totally agree with this. Sites that do financial transactions, or require user logons or user submissions (forums, comments etc.) need to be SSL, most others don't need to be secure at all. If I am reading a random blog by Joe, and he doesn't have a comments section, why does the site need to be in HTTPS? Scaling that up - if I'm not logged into Wikipedia, and simply searching and reading articles, why does that need to be served under HTTPS either? By forcing every site to go HTTPS not only increases the cost of ownership (in time, and optionally, cost) but also adds complexity for small site owners, and completely goes against the open web ideal. It should be down to the owner of the site if they want to add SSL, those that don't and fulfil the criteria I've outlined, should not be penalised for it. There's hardly any overhead involved if you add to the browsers page parsing routines a function to identify input fields, and mark a warning on the address bar accordingly if the site is not secure. Blanket warning on all non-HTTP sites is just lazy.
- asherkin 10y ago> Scaling that up - if I'm not logged into Wikipedia, and simply searching and reading articles, why does that need to be served under HTTPS either? Because a malicious MITM could modify the content you are reading (and thus affect your perception of a subject). A bit of misinformation here and there can go a long way.
- tdkl 10y agoTargeting Wikipedia is different then personal static blog of John Doe. Wikipedia has resources for this, John doesn't - hence threatening the open web.
- Flimm 10y agoThis is what it actually looks like in Chrome Canary: http://i.imgur.com/PN8OewF.png http://i.imgur.com/PN8OewF.png There is no announcement that I know of that Chrome will start highlighting http:// http:// sites with a red warning icon and the text "not secure". The headline is wrong. The article is cleverly worded to be misleading while technically correct.
- quickben 10y agoThe proper news would be that Chrome started properly highlighting all MITMed https pages in the enterprise setting where an organization just blankly subs the cert. Until then, everything else is PR and money grabbing.
- hannob 10y agoThis latest flash of "chrome marks http as insecure" news seems very premature. It's an experimental feature behind a flag and as far as I can see there's nowhere any indication that this will hit average users any time soon. Which is a bit disappointing. Chrome and later Mozilla announced years ago that they'd do this, yet as long as it's an announcement for some undefined point in the far future it doesn't create any pressure to the ecosystem to become more https friendly. I'm saying this as someone who regularly works for publications that can't use HTTPS, because Ad-networks don't care. I'd really wish Google/Mozilla make their plans to mark HTTP as insecure true.
- gokhan 10y agoIf Google starts serving ads over https without affecting revenue, many sites will convert overnight.
- helthanatos 10y agoRunescape need fix Runemetrics... Chrome almost always says it's insecure :(