5 ms·

I just realized: This site was never over HTTPS. It was an HTTP site, and the browser had a regression that broke the site's user functionality. Troy Hunt is a

I just realized: This site was never over HTTPS. It was an HTTP site, and the browser had a regression that broke the site's user functionality. Troy Hunt is attempting to claim this is a feature and not a bug, and that their workaround is "being deceptive", when they never claimed it was secure to begin with. The browser is literally pushing an idealistic philosophy down websites' throats and basically doing damage to businesses and brands without an attempt to help them, and any attempts to simply keep old functionality are being vilified as "anti-vaxers". This is not an honest narrative. Yes, Oil and Gas International had an insecure site, and yes, their reaction and demand to the browser vendor was inappropriate. But the point of it is still valid: as a vendor, you don't embarrass and damage business reputations in order to force them to comply with the way you would like them to run their sites. Troy writes in the article that browser vendors are trying to use a "lever" to "force organizations to go secure". I don't care who you are, it's wrong to force anyone to do anything they don't want to do, and on your timeline instead of theirs, and with absolutely no help given to them before this deadline. Imagine if Microsoft changed their OS to flag every single application as "insecure" if it doesn't implement a new primitive, and they pushed this out today. All of a sudden, you receive a barrage of calls from upset users. You didn't know they were going to push that out (certainly Microsoft never sent you an e-mail), and you now have to hit the ground running trying to figure out how to add those primitives to your code, test them, and release them, none of which could possibly happen immediately, and may take weeks of development. Meanwhile, your reputation with your users is damaged, and users themselves go through emotional stress and fear. And Microsoft's response? "Too bad. You should have been secure already." This is fucked up. And if Google does this knowing it's going to damage businesses, they could face a class-action lawsuit. The only way they get away with it is because they have the biggest market share. If Chrome had a smaller user base, businesses would simply shut off access to Chrome browsers and tell them their browsers were faulty and to switch to IE. This is impressively tyrannical behavior for a software vendor, and Google is indeed being a bully.

bzbarsky 9y ago
The key thing to realize here is that the browser is the "user agent": it is supposed to represent the interests of the user. Now users have pretty diverse interests, so browsers don't always get this entirely right, which is one reason it's important to have a variety of browsers so users can pick one that does represent their interests. What's happening in this case is that the site is doing something that pretty much everyone who understands the issue agrees is harmful to users: having them type their password into an insecure page. Browsers and security professionals spent 10+ years trying to convince web sites to stop doing that. Then browsers spent a few years telling websites that they will start warning users about this behavior and giving specific timelines for when this would happen. Then they started showing those warnings they promised they would show. To go back to your analogy, it's as if Microsoft had told developers for a long time that some specific API is deprecated due to being "insecure". Then they gave a timeline for the API being removed. Then they removed it. Can there still be applications who didn't move away from that API? Sure. Is it entirely Microsoft's fault that they are now getting lots of support calls? That's a hard case to make. Note that this sort of deprecation is something that Microsoft and Apple have in fact done. > The only way they get away with it is because they have the biggest market share. Firefox is showing the same warnings, no? > businesses would simply shut off access to Chrome browsers and tell them their browsers were faulty Sure, just like in the Microsoft case businesses tell their users to not install the OS security update, etc. You're right that if Chrome and Firefox had smaller marketshare businesses _could_ threaten to do this or actually do this. But at that point it's not entirely clear who the real "bully" is... In either case there's an exercise of market power to get your way against the (possibly reasonable) objections of others. Disclaimer: I work for Mozilla, on Firefox.
- peterwwillis 9y ago
  > the browser is the "user agent": it is supposed to represent the interests of the user > it's important to have a variety of browsers so users can pick one that does represent their interests First of all, I'm now terrified of Mozilla/Firefox, because this comment reflects the idea that browsers should be developed as independent ethical entities that represent different groups, in the way special interest groups lobby on behalf of specific people, ignoring the concerns of everyone else. Second, it's dangerous to put the onus of security on everyone but the user. I'm sure you've seen the wall of sheep: it's more than just http passwords. Users are stupid, and they get security wrong, and they need to be helped to get it right. But one thing that won't help them is absolving them of any thought whatsoever into investing in their own security. Where this will end is a marketing campaign that sounds a lot like "Mozilla Firefox: The Secure Browser". All they need to do is download your program and just assume everything is fine. Which will of course be a lie, but one that everyone will accept, because they want it to be true. The browser should not become a political toy. It should be simply a tool, and it should be up to those who wield that tool to decide how it is used. If I make an axe, I don't come to your farm and tell you how to swing it. This could have been trivially handled by simply asking users how much concern they want to have over their security, or providing some mechanism for organizations to easily transition into technology changes at a pace that works for them. Instead it seems like browser makers are too fond of themselves as white knights to provide reasonable compromises. Browsers are completely at fault for handling security so poorly in the first place. They continue to have the most asinine user experiences in the world when it comes to understanding what is actually going on when a user browses the web. They continue to support standards which can be easily subverted. They continue to build hack after hack into something that was supposed to just navigate documents and is now an entire fucking application platform. Browsers are a mess, and it's their designers that are at fault for that mess. Now it's clear that a mentality of moral superiority and special interests is the cause. And while I'm ranting, what is wrong with browsers that they can't simply build a working secure authentication framework into the protocol and back it with a halfway usable UI? How is it a 20 year old tool used to access backend servers has a more effective authentication and authorization system than the most commonly used program in the entire world? It's not like this stuff was some mystery that the poor lowly browser devs couldn't understand. We don't need to be relying on shitty web forms to send plaintext passwords - we didn't need to be doing that in the year 2000!!!! How the hell is it that this piece of software, which is somehow more complex than my entire operating system, can't seem to perform the basic functions i've been doing with other programs for half my life? And yet have the balls to claim they're working in service to the user? You know what would have been great for the users? A secure protocol which didn't degrade its own security. A URI convention that refuses to communicate with insecure sites. A button that rejects all connections not destined for the domain in the address bar, and functions that control the browser or access to its data without the user expressly allowing it. Simple things that could have actually completely ensured users' safety, without ridiculous complicated kludges that only do half of what they're supposed to do. And these should not be considered controversial - it's not like I'm suggesting they implement security policies before they add buggy features to brand new releases. You are right, though. Browsers did take 10+ years to enforce a policy that is as unnecessary as it is sudden. I'm sure users will thank the browser vendors now for how much safer they are from black hat hackers in coffee shops. Oh, wait - they are still insecure. It's just now they know it and are unhappy about it, and other organizations can now capitalize on this.
deadmetheny 9y ago
This isn't about pages that are just serving good old fashioned plain #content, it's about pages POSTing passwords. Hopefully there is no need to explain why that is bad. I agree with most of your post, but it's coming from an incorrect assumption.
- peterwwillis 9y ago
  It's not coming from an incorrect assumption.
deleted 9y ago
[deleted]

bzbarsky 9y ago

The key thing to realize here is that the browser is the "user agent": it is supposed to represent the interests of the user. Now users have pretty diverse interests, so browsers don't always get this entirely right, which is one reason it's important to have a variety of browsers so users can pick one that does represent their interests. What's happening in this case is that the site is doing something that pretty much everyone who understands the issue agrees is harmful to users: having them type their password into an insecure page. Browsers and security professionals spent 10+ years trying to convince web sites to stop doing that. Then browsers spent a few years telling websites that they will start warning users about this behavior and giving specific timelines for when this would happen. Then they started showing those warnings they promised they would show. To go back to your analogy, it's as if Microsoft had told developers for a long time that some specific API is deprecated due to being "insecure". Then they gave a timeline for the API being removed. Then they removed it. Can there still be applications who didn't move away from that API? Sure. Is it entirely Microsoft's fault that they are now getting lots of support calls? That's a hard case to make. Note that this sort of deprecation is something that Microsoft and Apple have in fact done. > The only way they get away with it is because they have the biggest market share. Firefox is showing the same warnings, no? > businesses would simply shut off access to Chrome browsers and tell them their browsers were faulty Sure, just like in the Microsoft case businesses tell their users to not install the OS security update, etc. You're right that if Chrome and Firefox had smaller marketshare businesses _could_ threaten to do this or actually do this. But at that point it's not entirely clear who the real "bully" is... In either case there's an exercise of market power to get your way against the (possibly reasonable) objections of others. Disclaimer: I work for Mozilla, on Firefox.

peterwwillis 9y ago
> the browser is the "user agent": it is supposed to represent the interests of the user > it's important to have a variety of browsers so users can pick one that does represent their interests First of all, I'm now terrified of Mozilla/Firefox, because this comment reflects the idea that browsers should be developed as independent ethical entities that represent different groups, in the way special interest groups lobby on behalf of specific people, ignoring the concerns of everyone else. Second, it's dangerous to put the onus of security on everyone but the user. I'm sure you've seen the wall of sheep: it's more than just http passwords. Users are stupid, and they get security wrong, and they need to be helped to get it right. But one thing that won't help them is absolving them of any thought whatsoever into investing in their own security. Where this will end is a marketing campaign that sounds a lot like "Mozilla Firefox: The Secure Browser". All they need to do is download your program and just assume everything is fine. Which will of course be a lie, but one that everyone will accept, because they want it to be true. The browser should not become a political toy. It should be simply a tool, and it should be up to those who wield that tool to decide how it is used. If I make an axe, I don't come to your farm and tell you how to swing it. This could have been trivially handled by simply asking users how much concern they want to have over their security, or providing some mechanism for organizations to easily transition into technology changes at a pace that works for them. Instead it seems like browser makers are too fond of themselves as white knights to provide reasonable compromises. Browsers are completely at fault for handling security so poorly in the first place. They continue to have the most asinine user experiences in the world when it comes to understanding what is actually going on when a user browses the web. They continue to support standards which can be easily subverted. They continue to build hack after hack into something that was supposed to just navigate documents and is now an entire fucking application platform. Browsers are a mess, and it's their designers that are at fault for that mess. Now it's clear that a mentality of moral superiority and special interests is the cause. And while I'm ranting, what is wrong with browsers that they can't simply build a working secure authentication framework into the protocol and back it with a halfway usable UI? How is it a 20 year old tool used to access backend servers has a more effective authentication and authorization system than the most commonly used program in the entire world? It's not like this stuff was some mystery that the poor lowly browser devs couldn't understand. We don't need to be relying on shitty web forms to send plaintext passwords - we didn't need to be doing that in the year 2000!!!! How the hell is it that this piece of software, which is somehow more complex than my entire operating system, can't seem to perform the basic functions i've been doing with other programs for half my life? And yet have the balls to claim they're working in service to the user? You know what would have been great for the users? A secure protocol which didn't degrade its own security. A URI convention that refuses to communicate with insecure sites. A button that rejects all connections not destined for the domain in the address bar, and functions that control the browser or access to its data without the user expressly allowing it. Simple things that could have actually completely ensured users' safety, without ridiculous complicated kludges that only do half of what they're supposed to do. And these should not be considered controversial - it's not like I'm suggesting they implement security policies before they add buggy features to brand new releases. You are right, though. Browsers did take 10+ years to enforce a policy that is as unnecessary as it is sudden. I'm sure users will thank the browser vendors now for how much safer they are from black hat hackers in coffee shops. Oh, wait - they are still insecure. It's just now they know it and are unhappy about it, and other organizations can now capitalize on this.

deadmetheny 9y ago

This isn't about pages that are just serving good old fashioned plain #content, it's about pages POSTing passwords. Hopefully there is no need to explain why that is bad. I agree with most of your post, but it's coming from an incorrect assumption.

peterwwillis 9y ago
It's not coming from an incorrect assumption.

deleted 9y ago

[deleted]