7 ms·

It was one of those minor chrome changes that shouldn't bother me, but ends up driving me slightly insane.

inetknght 10y ago
The dumbing down of Chrome is seriously driving me away. There used to be a ton of power-user-friendly options easily available. Now they're all hidden in favor of simplicity. My brother's been recommending Opera for a long time. I think it's time I listened to him and gave it a try.
- problems 10y ago
  There's a big difference in attitudes between browsers here. Take OCSP for example - Chrome disabled OCSP because in optional mode it wasn't a perfect solution and they didn't want to enable it in required mode because that could confuse the poor users. After the heartbleed attack, Chrome was only able to bundle a tiny fraction of the certificates into their CRLs - leaving millions of domains still vulnerable to blacklisted certificates. On Chrome - you're just screwed, there's no way to turn OCSP into required mode to prevent such attacks. On Firefox however you're able to force OCSP required - making it actually useful if you're sophisticated enough to understand what a failure of it may mean and you're actually able to blacklist all of those certificates. A huge security benefit in such a case.
  - wfunction 10y ago
    Edit: I'm wrong. Removing this comment regarding why certificate revocation checking is still useful, because someone pointed out you can create a new account to get a new certificate from a CA, and I didn't realize it was that easy to just sign up for a new account. (I was thinking of EV certificates mostly so I didn't think of this attack vector at all.) See [1] for background. Thanks all for pointing that out. [1] https://www.imperialviolet.org/2014/04/19/revchecking.html https://www.imperialviolet.org/2014/04/19/revchecking.html
    - problems 10y ago
      I think he's actually right about the attacker being near you most of the time - compromising a data center is much harder than compromising a LAN most of the time. However, he completely ignores the fact that some users may be sophisticated enough the handle the hard-fail scenarios mentioned. Well, I am. And so are many others. So what am I supposed to do if I want security and can handle hard-fails? Not use Chrome seems to be the answer. Chrome fails to account for power users and developers who would rather have improved security and functionality.
      - tptacek 10y ago
        What's your alternative? A customized Chromium fork? Every other browser is markedly less secure than Chrome. If exploit resilience is all you care about, you can theoretically use Edge, but now you're throwing away a lot of important TLS policy stuff that Chrome does and Microsoft is years behind on.
        problems 10y ago
        Firefox - they're years ahead on this sort of stuff. Their about:config gives you immense power to configure your browser to behave exactly how you want it to. Unlike any other browser around really. The flexibility this brings you in privacy gains alone is immense. Just try to do something as basic as turn off WebRTC in Chrome and you'll see what I'm talking about. Firefox is the only viable answer if you care about privacy and security and have the ability to take things into your own hands.
        tptacek 10y ago
        Virtually nobody who works in browser security agrees with you about that. There are privacy wins to be had with Firefox, but they come at the expense of security.
        problems 10y ago
        That's a pretty big claim, one which I'm guessing you're offering absolutely no evidence to back up?
  - tptacek 10y ago
    Without widespread adoption of a must-staple extension, OCSP is cosmetic. The decision to disable it didn't come from simplicity fascists; it came from people like Adam Langley. AGL isn't right about everything, but if you take the position that something he does with Chrome TLS is ludicrous, my default will be that you don't understand the issue as well as he does.
    - problems 10y ago
      > Without widespread adoption of a must-staple extension, OCSP is cosmetic. The decision to disable it didn't come from simplicity fascists; it came from people like Adam Langley. AGL isn't right about everything, but if you take the position that something he does with Chrome TLS is ludicrous, my default will be that you don't understand the issue as well as he does. Well, please, do explain where I'm mistaken here - is OCSP required not the most secure option? And it was rejected simply due to usability reasons on Chrome? And the option to do so anyways for power users doesn't exist because Chrome is a browser for ease of use? I'm not saying it's entirely ludicrous - for a good chunk of the user base CRLs are at least decent - but having an option for power users who desire more security should be available. And it's mandatory for any browser that wants to be used by power users. Stop with the appeals to authority and make an actual argument if you disagree.
      - tptacek 10y ago
        I don't understand the questions you're asking here, but, no, OCSP wasn't disabled simply due to usability reasons, but rather because it did not work.
        problems 10y ago
        It works just fine if you require an OCSP response and hardfail. Soft-failing is for usability and it's the cause of the problem. Yes, must-staple is the optimal solution, but OCSP required is the best available today. Look at some of the numbers here: https://www.grc.com/revocation/crlsets.htm https://www.grc.com/revocation/crlsets.htm
- xtracto 10y ago
  Interesting assertion. Back in 2008 when Chrome was released, that was exactly the same feeling people had about it. I remember some of us where sad to see the search bar and address bar combined, along with other stuff that Firefox, Explorer and other browsers had. If I remember correctly, one of Chrome's objectives since the beginning has been to remove a lot of functionality and clutter (o yeah, the menu bar was another thing that Chrome did not have and drove some people crazy).

The dumbing down of Chrome is seriously driving me away. There used to be a ton of power-user-friendly options easily available. Now they're all hidden in favor of simplicity. My brother's been recommending Opera for a long time. I think it's time I listened to him and gave it a try.

problems 10y ago
There's a big difference in attitudes between browsers here. Take OCSP for example - Chrome disabled OCSP because in optional mode it wasn't a perfect solution and they didn't want to enable it in required mode because that could confuse the poor users. After the heartbleed attack, Chrome was only able to bundle a tiny fraction of the certificates into their CRLs - leaving millions of domains still vulnerable to blacklisted certificates. On Chrome - you're just screwed, there's no way to turn OCSP into required mode to prevent such attacks. On Firefox however you're able to force OCSP required - making it actually useful if you're sophisticated enough to understand what a failure of it may mean and you're actually able to blacklist all of those certificates. A huge security benefit in such a case.
- wfunction 10y ago
  Edit: I'm wrong. Removing this comment regarding why certificate revocation checking is still useful, because someone pointed out you can create a new account to get a new certificate from a CA, and I didn't realize it was that easy to just sign up for a new account. (I was thinking of EV certificates mostly so I didn't think of this attack vector at all.) See [1] for background. Thanks all for pointing that out. [1] https://www.imperialviolet.org/2014/04/19/revchecking.html https://www.imperialviolet.org/2014/04/19/revchecking.html
  - problems 10y ago
    I think he's actually right about the attacker being near you most of the time - compromising a data center is much harder than compromising a LAN most of the time. However, he completely ignores the fact that some users may be sophisticated enough the handle the hard-fail scenarios mentioned. Well, I am. And so are many others. So what am I supposed to do if I want security and can handle hard-fails? Not use Chrome seems to be the answer. Chrome fails to account for power users and developers who would rather have improved security and functionality.
    - tptacek 10y ago
      What's your alternative? A customized Chromium fork? Every other browser is markedly less secure than Chrome. If exploit resilience is all you care about, you can theoretically use Edge, but now you're throwing away a lot of important TLS policy stuff that Chrome does and Microsoft is years behind on.
      - problems 10y ago
        Firefox - they're years ahead on this sort of stuff. Their about:config gives you immense power to configure your browser to behave exactly how you want it to. Unlike any other browser around really. The flexibility this brings you in privacy gains alone is immense. Just try to do something as basic as turn off WebRTC in Chrome and you'll see what I'm talking about. Firefox is the only viable answer if you care about privacy and security and have the ability to take things into your own hands.
        tptacek 10y ago
        Virtually nobody who works in browser security agrees with you about that. There are privacy wins to be had with Firefox, but they come at the expense of security.
        problems 10y ago
        That's a pretty big claim, one which I'm guessing you're offering absolutely no evidence to back up?
- tptacek 10y ago
  Without widespread adoption of a must-staple extension, OCSP is cosmetic. The decision to disable it didn't come from simplicity fascists; it came from people like Adam Langley. AGL isn't right about everything, but if you take the position that something he does with Chrome TLS is ludicrous, my default will be that you don't understand the issue as well as he does.
  - problems 10y ago
    > Without widespread adoption of a must-staple extension, OCSP is cosmetic. The decision to disable it didn't come from simplicity fascists; it came from people like Adam Langley. AGL isn't right about everything, but if you take the position that something he does with Chrome TLS is ludicrous, my default will be that you don't understand the issue as well as he does. Well, please, do explain where I'm mistaken here - is OCSP required not the most secure option? And it was rejected simply due to usability reasons on Chrome? And the option to do so anyways for power users doesn't exist because Chrome is a browser for ease of use? I'm not saying it's entirely ludicrous - for a good chunk of the user base CRLs are at least decent - but having an option for power users who desire more security should be available. And it's mandatory for any browser that wants to be used by power users. Stop with the appeals to authority and make an actual argument if you disagree.
    - tptacek 10y ago
      I don't understand the questions you're asking here, but, no, OCSP wasn't disabled simply due to usability reasons, but rather because it did not work.
      - problems 10y ago
        It works just fine if you require an OCSP response and hardfail. Soft-failing is for usability and it's the cause of the problem. Yes, must-staple is the optimal solution, but OCSP required is the best available today. Look at some of the numbers here: https://www.grc.com/revocation/crlsets.htm https://www.grc.com/revocation/crlsets.htm
xtracto 10y ago
Interesting assertion. Back in 2008 when Chrome was released, that was exactly the same feeling people had about it. I remember some of us where sad to see the search bar and address bar combined, along with other stuff that Firefox, Explorer and other browsers had. If I remember correctly, one of Chrome's objectives since the beginning has been to remove a lot of functionality and clutter (o yeah, the menu bar was another thing that Chrome did not have and drove some people crazy).