54 ms·

Chrome 68 will mark all HTTP sites as “not secure”

• Klathmon 9y ago
  I'm glad this is happening, although I'm more excited for the day when they start very obviously marking password input fields as "NOT SECURE" when they are used on HTTP sites. Although I am genuinely surprised how much Google and others like Mozilla have had to drag many site owners kicking and screaming into HTTPS. I never would have imagined that end-to-end encryption by default would be consitered "controversial". Also, those HTTPS numbers are amazing! * Over 68% of Chrome traffic on both Android and Windows is now protected * Over 78% of Chrome traffic on both Chrome OS and Mac is now protected * 81 of the top 100 sites on the web use HTTPS by default
  • deleted 9y ago
    [deleted]
  • Santosh83 9y ago
    >I'm glad this is happening, although I'm more excited for the day when they start very obviously marking password input fields as "NOT SECURE" when they are used on HTTP sites. Mozilla already does this with Firefox: https://support.mozilla.org/en-US/kb/insecure-password-warning-firefox?as=u&utm_source=inproduct https://support.mozilla.org/en-US/kb/insecure-password-warni...
    • schoen 9y ago
      Maybe Klathmon was envisioning it appearing inside the password field itself (not just in the browser chrome)?
      • Ajedi32 9y ago
        Firefox _does_ do it in the password field itself: https://prod-cdn.sumo.mozilla.net/uploads/gallery/images/2017-04-21-23-52-53-ba340d.png https://prod-cdn.sumo.mozilla.net/uploads/gallery/images/201... Doesn't seem like Chrome's planning to do it that way though.
        • schoen 9y ago
          Oh yeah, thanks for pointing that out! Maybe Chrome would be up for it at some point in the future as HTTP form submissions become rarer, though I don't know how they made this decision. Edit: Amusingly, even though I normally use Firefox, I haven't noticed this UI element recently because I'm so conscious of HTTPS—working on Let's Encrypt and support for it—that I rarely even try to enter information into a non-HTTPS site in the first place. :-) (so I might not be quite the target audience for this notification)
  • pjmlp 9y ago
    I am glad, but it also pisses me off. Computer goes out of sync with some kind of cache server, welcome to HSTS errors and not able to surf to any site with cached content there. Visit customers that have self signed certificates on their guest network, hello LTE to be able to do anything.
    • Klathmon 9y ago
      To be completely honest, this kind of counter-argument (not that you are advocating against HTTPS, but bear with we) always reads to me like "people forget passwords, and don't like having to type usernames, so we just rely on the honor system". Yes, security has downsides, but in my opinion those downsides are well worth it for the benefits.
      • AnIdiotOnTheNet 9y ago
        That very much depends on the circumstances doesn't it?
      • badsectoracula 9y ago
        Personally i wouldn't mind it that much if the browser let me bypass the error but HSTS seems to mean "even if the site would work fine otherwise, keep it broken". There have been several cases where i couldn't bypass such an error in a site that i just wanted to read something and i was very surprised to see that Firefox didn't had any about:config option to indicate that "i know what i am doing, let me in". So much for taking back the web. Seems it was only temporary so we can hand it to Google.
        • ancarda 9y ago
          If browsers allowed you to bypass HSTS, then it could be easily defeated by an attacker by breaking the traffic on port 443, forcing the user to disable SSL for the site. What would be the point over regular SSL? HSTS was designed as a response to programs like sslstrip, where the implementation of SSL may be attacked so the user is made vulnerable. If a website puts out an HSTS header, they are telling the browser they need a higher bar of security than regular SSL.
  • m_eiman 9y ago
    Required maintenance for a simple, static http site: none. Required maintenance for a simple, static https site: configure let’s encrypt and keep the cron job running. Big difference? Not for some, but it sure is something that offers very little value for very many site owners. Even the top 100 sites are only at 80% https by default, and they do it for a living!
    • AstralStorm 9y ago
      A server is not a site.
    • JankySolutions 9y ago
      Required maintenance for a simple, static https site: Install certbot, press enter a few times, forget about it. "keep a cron job running" sounds like it you're running the cron job by hand. >Even the top 100 sites are only at 80% https by default, and they do it for a living! That's entirely separate from your "simple, static site" example and yes, rolling any sort of large change out to a big site is a big deal, and if there isn't business motivation to do it it likely wont happen. Google is providing everyone a business motivation by threatening to point out to users that insecure sites are insecure.
      • dfabulich 9y ago
        > "keep a cron job running" sounds like it you're running the cron job by hand. Cron jobs fail sometimes. You have to monitor them, investigate why they failed, fix the issue, and rerun them. Web servers fail, too, but with shared hosting, it's mostly not your problem. And shared hosting providers are still trying to charge an arm and a leg to manage SSL certs for you (because it's a nice high-margin business for them).
        • tokenizerrr 9y ago
          1. You don't have to monitor your cronjobs. They'll send you an email when they produce output. 2. Let's Encrypt will send you an email if your certificate is going to expire in a month. This will normally never happen, since it is continuously renewed.
  • badsectoracula 9y ago
    > Although I am genuinely surprised how much Google and others like Mozilla have had to drag many site owners kicking and screaming into HTTPS Personally i am very concerned about how much power Google has over the web - all it takes to change millions of how web sites work and look like is a random decision by Google. What bothers me even more is that most people do not seem to care much because they happen to agree with what Google is doing (so far). However i think that sites should make decisions on their configuration, layout, mobile friendliness and other things because they want to, not because they are forced by Google through taking advantage of their position and biasing what people see towards what they believe people should see. I do not like that Google basically dictates how the web should behave. (actually it isn't only the web, but also mail - just recently i had a mail of mine end up in the spam folder of someone else's GMail account because who knows what of the 1983847813 things i didn't configured exactly as Google likes it in my mail server... and of course the "solution" that many people present to this is to hand all my communications to Google)
    • Avamander 9y ago
      > 1983847813 things And by that you mean?
      • trav4225 9y ago
        Probably the dozens of various DNS, DKIM, SPF, SMTP behavior config, non-consumer-IP, etc., etc. boxes that must be ticked just right in order to not be considered a spammer these days. It's very difficult to get it all correct enough to keep a significant portion of the email sent through your SMTP site from being considered spam by mainstream email providers such as Google.
        • agentdrtran 9y ago
          yeah, but all of these things exist becuase of the sheer amount of spam that gets sent to people.
          • 9y ago
  • saas_co_de 9y ago
    > I never would have imagined that end-to-end encryption by default would be consitered "controversial" The whole point of Google's https crusade is to secure users from ISPs profiling their browsing activity, which for them is about eliminating the competition because they still monitor and track everyone and so if they knock the ISPs out they solidify their monopoly position. HTTPS is not bad but Google's motives (in the context of their business model and monopoly position) are and that gives some people pause.
    • adtac 9y ago
      Wow, I'm genuinely surprised someone managed to spin something like Google advocating for a secure web into a monopoly agenda. I get it, corporations are evil. But not every move. Why can't this simply be something out of goodwill?
      • josteink 9y ago
        > I'm genuinely surprised someone managed to spin something like Google advocating for a secure web into a monopoly agenda You are surprised to see people expecting more monopolistic behavior from the biggest monopolist on the web? I have bridges for you.
        • wpietri 9y ago
          I don't think this needs to be seen as a monopoly move. Think of it instead like health inspections for restaurants. In theory, restaurateurs would hate health inspections, because they're intrusive regulation with no direct benefit. But they have a lot of indirect benefit, in that the safer people feel going to restaurants, the more likely they are to go out to eat. Similarly, the safer the web is, the better off Google is, because people do more things on the web. That does benefit them, sure, but I don't think it benefits them disproportionately, let alone harms other legitimate competitors.
          • indubitable 9y ago
            Source on people eat out more when there are health inspections? I've lived and traveled to many countries where there are no meaningful food inspections whatsoever, and your statement there really does not pass the sniff test. And as an aside there also tend to be far more independent restaurants since if you can cook something well, then all you need do is plop out a table, put up a sign, and you're in business.
  • stevenicr 9y ago
    "obviously marking password input fields as "NOT SECURE"" - firefox has been doing this for a while, confuses some of my users - I am glad it's there, but wish it did not completely cover the login button on wordpress fields. Very glad there is a "learn more" attached to this. "Google and others like Mozilla have had to drag many site owners kicking and screaming" - I was dragged into this by the Google threats. Spent hours on it. Come to find our most popular few pages use a script that just will not function over https - no way to make it happen. Then I spent hours crafting htaccess rules to make some pages https (home and password pages) - and some pages forced non-https (the 5 pages we have with needed chat script on them) - more hours into updating links on all pages and everything - then come to find out the browsers have a function where if your home page is https only then it can't pull the sub pages as non-https (maybe it's the other way around, it's been a while) - So I had to go and undo all the changes. I've been spending time trying to help develop newer chat scripts to have all the functionality of the old one our users prefer - and to no avail. So as google forces https use on sites to be in it's results, and now to not be labeled as insecure - we currently have to choose to remove our most popular functions on our site or lose the google battle completely. We are still trying to get a newer chat system up and running that has our old familiar functions, but we don't have the resources that google and others have obviously. We want https so bad, we love, love, love more encryption the better. It just has not been an easy thing for us to implement, and we've tried many things, included pushing our users to newer html5 based chat systems and such. Nothing has panned out quite yet. Fingers crossed we make strides in these areas before it gets worse.
    • heywire 9y ago
      No offense, but this can't have come as a surprise. The writing has been on the wall for a very long time. I'm glad that Google is forcing company's hands here, because it is obvious that if they didn't, some would never "find time" to get it done.
    • heartbreak 9y ago
      You may want to update the website linked via your HN profile as well. To start with, every page includes unicode replacement characters mixed into the text.
  • zerostar07 9y ago
    it's not end-to-end encryption. it's end-to-end with a middleman issuing cerificates who's not trustless.
  • deleted 9y ago
    [deleted]
  • btym 9y ago
    >81 of the top 100 sites on the web use HTTPS by default I find it disappointing that there are any sites that large that are using HTTP.
  • dx034 9y ago
    I'm actually quite shocked that 19 of the top 100 pages still use http by default. For small or internal pages that's fine but top 100 pages on the internet? Any idea which pages they're talking about?
    • tialaramex 9y ago
      Google's Transparency Report shows a list of which top sites do modern HTTPS by default, which do it but only if you explicitly request the HTTPS site, and which have crappy (e.g. TLS 1.0 only, or they require 3DES) cryptography, and which have nothing at all. https://transparencyreport.google.com/https/top-sites https://transparencyreport.google.com/https/top-sites The last category features many Chinese sites. I could speculate about why that is, maybe the Great Firewall gives citizens no reason to bother trying to achieve security, maybe Chinese culture opposes privacy, maybe everybody in China is running Windows 95 still. But whatever the reason, that's an observable fact. There's also a whole bunch of crappy British tabloid newspapers there. Given their print editions are specifically printed on the worst quality paper that will take print ink, and they are routinely accused of "gutter" journalism, perhaps it isn't a surprise that defending their reputations through the use of encryption isn't a priority? Or you know, maybe British culture... British great firewall... etcetera. No idea.
• thinkloop 9y ago
  > and it unlocks performance improvements I thought https added performance overhead, where does it improve it?
  • JeremyBanks 9y ago
    They're gating HTTP/2 (and other new features) to HTTPS. It "unlocks" them in the sense that the browser vendors don't lock the features on HTTPS like they do on HTTP. :P
  • CiPHPerCoder 9y ago
    Nope. http://www.httpvshttps.com http://www.httpvshttps.com https://www.httpvshttps.com https://www.httpvshttps.com See also: https://istlsfastyet.com https://istlsfastyet.com
    • tptacek 9y ago
      This is a pretty bogus comparison; it's HTTP/2 versus HTTP/1.1.
      • CiPHPerCoder 9y ago
        It's HTTP/2 over TLS versus HTTP/1.1 without TLS.
        • tptacek 9y ago
          Yes. The performance benefit isn't really TLS.
          • CiPHPerCoder 9y ago
            Given that "currently no browser supports HTTP/2 unencrypted" they're inseparable in the real world. https://http2.github.io/faq/#does-http2-require-encryption https://http2.github.io/faq/#does-http2-require-encryption
• styfle 9y ago
  > Over 68% of Chrome traffic on both Android and Windows is now protected > Over 78% of Chrome traffic on both Chrome OS and Mac is now protected This is an interesting way to report HTTPS usage. Why are Android and Windows grouped together and why are Chrome OS and Mac OS grouped together?
  • fooey 9y ago
    claiming 68% of traffic is https is far different from claiming 68% of sites are https too I suspect the vast majority of sites are still not https, but the big sites are which skews that number
    • dingo_bat 9y ago
      That's ok but what the OP was getting at is the strange OS grouping.
  • testplzignore 9y ago
    My guess is that it was just a way to keep the message simple and not have too many numbers to distract the reader. The numbers for each pairing were probably conveniently close together, so combining them cut out two bullet points from an already very short blog post.
• makecheck 9y ago
  Generally I hate these warnings because they are extremely stubborn while not really telling the user what could fix the problem. They also don’t explain why the error might show up today when everything was fine yesterday. I’d much prefer a message like: “There is no way to verify that this site really is who it claims to be (possibly due to an expiration date, as sites must periodically renew their validations). The owner of the real site can resolve this error by using certification services such as LetsEncrypt. A secure connection is not possible until the site renews its validation.”.
  • tptacek 9y ago
    The user in this case is a random web browser piloted by a non-technical person. It doesn't make any sense to try to arm them with technical solutions to the problem; that's the site owner's job.
    • CiPHPerCoder 9y ago
      I foresee site owners complaining, and then this bit of history being repeated: https://arstechnica.com/information-technology/2017/03/firefox-gets-complaint-for-labeling-unencrypted-login-page-insecure/ https://arstechnica.com/information-technology/2017/03/firef...
      • ancarda 9y ago
        What I find really interesting is the website in question, oilandgasinternational.com, now has SSL on by default now; it'll redirect you from any page if accessed over HTTP. Given that, perhaps we should just let them complain? It seems to raise awareness over the need for SSL.
    • throwaway2048 9y ago
      Errors that were more informative than "Oh u made a boo boo :((" would be useful.
  • theandrewbailey 9y ago
    Even if it did, there would still be a barrage of vague "I came to your site and there was a big scary error on it" messages from users.
• cryo 9y ago
  This totally sucks for web based services and sites which don't have a (user friendly) chance to use HTTPS. Think of LAN only IoT devices which aren't proxy through a external company site, have no domain, are accessed through (local area network IP) and maybe run in non internet environment. I wish there was a solution for web based encryption for this application domain and browser vendors start to think out of their internet only box. ... same goes for service workers.
  • quotheth 9y ago
    OK, so in your example they create a certificate and use HTTPS and I'm unsure what the problem is. And why would they think outside of their internet only box when they're providing an internet browser?
    • tokenizerrr 9y ago
      It's impossible to get a valid SSL certificate for an appliance running within someone their lan, without having to open ports. And opening ports would make the appliance even more vulnerable to attack.
      • quotheth 9y ago
        > It's impossible to get a valid SSL certificate for an appliance running within someone their lan Can you not just create a certificate and push it to the system as a trusted cert? > And opening ports would make the appliance even more vulnerable to attack. Presumably there is already some sort of communication going on if they're receiving Chrome updates.
        • tokenizerrr 9y ago
          > Can you not just create a certificate and push it to the system as a trusted cert? If you were to control the user's machine, yes. But imagine you bought a shiny new internet connected coffee pot. Once you turn it on it does the following: 1. Coffeepot Determines its LAN IP address (e.g. 192.168.1.100) 2. Coffeepot connects to the coffeepot cloud service to register a dynamic DNS entry (e.g. user1.coffeepot.com) to point to its LAN IP address. 3. User is told they can access their coffeepot WebUI by going to user1.coffeepot.com, which resolves to 192.168.1.100 This is secure since the coffeepot can only be controlled if you are in the same network. Yet, since the coffeepot webui can only be reached if you are in its network, it is nearly impossible to get a valid SSL certificate on the coffeepot appliance. > Presumably there is already some sort of communication going on if they're receiving Chrome updates. There is a difference between outgoing network traffic and incoming network traffic. Only the latter requires open ports.
• atomicnumber1 9y ago
  I've a simple text blog hosted on GitHub pages. Github Pages doesn't allow https for custom domains. Am I screwed?
  • pornel 9y ago
    No, GitHub is, because their product will become less attractive. Presumably they'll fix it before the deadline.
• thresh 9y ago
  Welcome to the world where ad company tells you which sites you should look at.
  • IncRnd 9y ago
    Welcome to the world that used to say not to talk to strangers and not to get in stranger's cars. Welcome to the brave new world where kids now summon strangers over the internet in order to be driven in the stranger's car.
• baggachipz 9y ago
  One small annoyance/drawback with everything moving to https: I travel a fair bit, and hotel wifi usually relies on users connecting to their AP and then using a DNS-based redirect to send the user to the login page. That only happens when on http, as https sites which are redirected get the MITM warning from the browser. I used to be able to just type in "google.com" in the address bar and be redirected accordingly; nowadays I struggle to remember a site I use which isn't https. Looking up the gateway address is kind of a pain too.
  • CiPHPerCoder 9y ago
    http://neverssl.com/ http://neverssl.com/
    • gowld 9y ago
      Alternatively, try "This well known URL": http://clients3.google.com/generate_204 http://clients3.google.com/generate_204 https://www.chromium.org/chromium-os/chromiumos-design-docs/network-portal-detection https://www.chromium.org/chromium-os/chromiumos-design-docs/...
    • racer-v 9y ago
      I use the neverssl.com trick and I worry: if browsers stop supporting plan HTTP, doesn't it mean this won't work anymore?
      • dx034 9y ago
        No, worst case you'll see a security warning. Or chrome will add an exception for such a site. This is a well known problem that I'm sure will be addressed. But with the current state of the web (~20% unencrypted) it's not really an issue yet.
        • gpvos 9y ago
          If it were addressed in a way that would break captive portals forever, so much the better.
• tokenizerrr 9y ago
  I don't understand what is insecure about http://example.com http://example.com? It's a simple static site which does not allow user input.
  • quotheth 9y ago
    I'll assume you intended to write 'insecure'. I'd say the main issue is that anyone between you and that website can inject scripts into the site in order to phish/ exploit you.
    • tokenizerrr 9y ago
      That's not a security issue if the site doesn't ask for user input, though.
      • quotheth 9y ago
        Sure it is. If I have a Chrome exploit that I want to deliver to you and I'm on your network I can inject it into the webpage.
        • tokenizerrr 9y ago
          Yeah. You could also just host it literally anywhere and post an URL in the comments here. By that logic clicking on hyperlinks is equally insecure.
          • quotheth 9y ago
            Your argument seems to be that because there are multiple ways to exploit people that closing any of those methods is not useful. I shouldn't have to explain why this is not a meaningful argument. What I will say is that in many cases an attacker is far more capable of MITM than they are of posting forum comments, or otherwise convincing you to click a link. A phishing campaign is noisy - you are often alerting many parties that you're malicious. MITM within a network is much stealthier and you don't have to rely on users clicking on anything. Really, they're just completely different attacks and the existence of one has no bearing on the other. TLS on every page would close off real attacks and, if it forced attackers to use noisy methods like phishing, that's a huge win.
• AnabeeKnox 9y ago
  Ironically, the thing stopping me moving my website to HTTPS is Google themselves! There is no clear and unambiguous way to move my website from HTTP to HTTPS without GUARANTEEING that my search index rankings will not fall in the Google search index. This is because Google treat the HTTP and HTTPS versions of the same resource as separate pages. Until they fix this, I'm sticking with HTTP. A drop in our search rankings would be a catastrophe.
  • setr 9y ago
    Couldn't you have both, and wait till the https version starts to approach parity with the original? I'm imagining google would favor https over http in ranking, so over time it should rise
    • AnabeeKnox 9y ago
      2 separate pages with the same content is penalised by Google. They are quite clear about that. I will switch on HTTPS tomorrow if Google make it so that a protocol change does not affect search indexing. My business depends on this. Do a Google search and see all the people whose websites have been demolished by dropping out of the Google rankings after implementing HTTPS. Absurd!
      • Confiks 9y ago
        There are a few well documented methods to counter that penalty: https://support.google.com/webmasters/answer/139066?hl=en https://support.google.com/webmasters/answer/139066?hl=en. The easiest method is probably to configure your webserver to start sending 'rel=canonical' in a Link HTTP header, but it can also be done with a meta-tag.
    • CydeWeys 9y ago
      You should only ever have a single canonical version of your content. Serve your stuff on one path and one path only, and everything else redirects to it. The solution here is to serve on https and redirect http to it.
  • 9y ago
• ad_hominem 9y ago
  Predicting a noticeable bump in Cloudflare users around July when people need a quick way to make their sites "secure"
  • josefresco 9y ago
    Thankfully this is an option, and one we may have to take for our clients hosted with companies that do not make this process easy (or cheap)
• marknadal 9y ago
  HTTPS helps secure traffic between two parties, but that has nothing to do with whether that end party (ahem, Google, or Equifax, ahem) is secure. If we want real security we need to put cryptographic keys in P2P identities, so users control end-to-end everything they do. No middleman can tamper with it. Obviously, I'm opinionated because we're working on solving this, and creating a truly SECURE and DECENTRALIZED web: http://hackernoon.com/so-you-want-to-build-a-p2p-twitter-with-e2e-encryption-f90505b2ff8 http://hackernoon.com/so-you-want-to-build-a-p2p-twitter-wit... !
• megous 9y ago
  I predict "Not secure" will lose meaning for many people. There's just too many non-https websites. Traffic is not a relevant metric for this. Tell me how many of the websites that a user visits are http. It's easy: sqlite3 places.sqlite 'select url from moz_places' | cut -d / -f 1,3 | sort | uniq | cut -d : -f 1 | sort | uniq -c 4915 http 4227 https
  • Ajedi32 9y ago
    According to Google's own statistics, even Android users now spend 70% of their time on HTTPS sites: https://transparencyreport.google.com/https/overview https://transparencyreport.google.com/https/overview For Windows users, it's more like 80%, and 85% for Mac users. And those numbers went up ~10% over just the last year.
    • megous 9y ago
      That matches my personal numbers for page views too, but TLS is site specific and not page specific, and it is deployed on small minority of websites on the internet (20-25% of top 1mil.), so my point still holds. I may spend 80% of my time (whatever that means) on a few HTTPS websites, but I also spend 20% of my time browsing much larger proportion of non-https websites. So the warning will be popping out a lot and will soon become a thing to ignore.
  • minitech 9y ago
    It’d be better to only include non-HTTPS entries when an HTTPS entry doesn’t also exist: $ sqlite3 places.sqlite 'select url from moz_places' | python3 -c ' import sys, urllib.parse v = [urllib.parse.urlparse(l) for l in sys.stdin] secure = {u.hostname for u in v if u.scheme == "https"} insecure = {u.hostname for u in v if u.scheme == "http"} print(len(insecure - secure), len(secure))' 430 1124 Even this will miss places you haven’t visited in a while that have since added security, though.
    • megous 9y ago
      You're right, it's still roughly fifty fifty for me: 3946 4236
• hcurtiss 9y ago
  It occurs to me that Google has some incentive to do this. Ad blocking is much more difficult with https and requires an ordinary user inject a certificate of dubious origin/security.
  • ams6110 9y ago
    Pardon me? How does this make ad blocking any more difficult. uBlock does not MITM ad sites AFAIK, it simply stops them loading.
    • ronnier 9y ago
      Some people don't run adblockers on their client, they do it at centralized location, like with pihole to block at the DNS level. https can impact pihole. See this... > Since Pi-hole only knows about the domain being requested and not the protocols being used to access it, Pi-hole will intercept HTTPS advertisements and since the Pi-hole does not have the certificate of the actual server being queried, you may see slow loading times waiting for the request to time out. https://pi-hole.net/2018/02/02/why-some-pages-load-slow-when-using-pi-hole-and-how-to-fix-it/ https://pi-hole.net/2018/02/02/why-some-pages-load-slow-when...
  • craftyguy 9y ago
    > Ad blocking is much more difficult with https and requires an ordinary user inject a certificate of dubious origin/security. What do you mean? I can see how this might apply if you're trying to MITM your https requests and ad block them that way, but a browser (or its plugin) can simply choose not to display an element on the page without doing that.. right?
    • kuschku 9y ago
      On Android, since 8.0, users can not override the CAs that applications use anymore. With SSL everywhere, you can't use a VPN to intercept anymore, as you can't get your own CA into the truststore. This means ad blocking in apps is now impossible. Okay, because everyone just downvotes this without reason, here's Google's official Android Dev blog stating exactly the same I just did: https://android-developers.googleblog.com/2016/07/changes-to-trusted-certificate.html https://android-developers.googleblog.com/2016/07/changes-to...
• krick 9y ago
  Oh, if only there was an alternative to Google Chrome...
  • Something1234 9y ago
    There is. Firefox quantum is better than Chrome. The only thing is pushbullet doesn't quite show popus correctly. It works with all the major streaming services, and just feels better. Now if only client side window decoration would come sooner, I want to ridded of that ugly title bar. I miss fedora's firefox 57 build.
    • gmueckl 9y ago
      Has alsa support returned in the Linux build? Unless that is the case, Firefox is absolutely useless to me.
      • richjdsmith 9y ago
        FF Quantum is in the latest Linux build, if that's what you mean. So I'm assuming support has returned?
      • Something1234 9y ago
        Why does alsa support matter? I'm very fuzzy about how sound works on Linux.
    • staticelf 9y ago
      Unfortunately, the html inspector in quantum is not as good as it used to be. I don't know why but it often refuses to find the correct element. I use Firefox as my main browser since quantum but for development I have to use Chrome or else I'd go mad. I'm sure they're going to fix that soon, but until that happens it's very frustrating. For example, if the site is loading there is no way to inspect the elements that are already loaded.
• kstrauser 9y ago
  Fine, as long as they don't eventually make it difficult or impossible to ignore the warnings (as they've done with SSL sites with invalid certs). I have numerous devices with web interfaces that are 100% internal to my network and not reachable from the open Internet, but Chrome still refuses to let me access them (side note: thanks, Firefox, for respecting my decision as a user!). I can envision a near future where Chrome treats HTTP sites the same way.
  • judge2020 9y ago
    You can still visit websites that have an invalid CA or invalid certificate DNS match, but if the website is set up for HSTS/HSTS preload then chrome respects the website's decision to not allow insecure connections.
    • ocdtrekkie 9y ago
      The problem is when Google goes and throws a commonly used internal-only TLD like .dev in their HSTS list. And of course, the whole problem that HSTS is the hosts file all over again. That being said, the real fault in that incident is ICANN selling .dev in the first place. They should've been well aware of it's common use, and opted not to sell it.
      • sattoshi 9y ago
        I have a theory that ICANN did this too tell developers to use designated domains for internal uses.
        • ocdtrekkie 9y ago
          I think you're putting too much thought into it. It's very simple: .dev is a massively easy to monetize TLD, it was guaranteed to get multiple companies trying to buy it, and when they had multiple offers, they got auctioned. I think .dev was just too much money for ICANN to say no. Of course, it looks like ICANN may have gotten screwed, because Amazon and Google appear to have privately arranged to figure out who was going for which TLDs: https://icannwiki.org/.dev https://icannwiki.org/.dev
• Waterluvian 9y ago
  I have only ever made internal web apps that don't live on the internet. Where do I begin for an idiot's guide to switching to HTTPS? I want the shortest path to switching nginx over and getting an SSL cert. I think that's all I need to worry about?
  • deleted 9y ago
    [deleted]
  • ReverseCold 9y ago
    https://www.digitalocean.com/community/tutorials/how-to-secure-nginx-with-let-s-encrypt-on-ubuntu-16-04 https://www.digitalocean.com/community/tutorials/how-to-secu... This is the easiest tutorial I've found. It's 99% copy/paste with sane defaults.
    • Waterluvian 9y ago
      Wonderful! Thank you for taking the time to share.
  • deleted 9y ago
    [deleted]
• amgin3 9y ago
  This is a really stupid move. There are plenty of instances where websites do not need to use HTTPS, like simple static websites for small businesses that do not collect personal user information. This is going to cause a lot of confusion and outrage when it is implemented.
  • orangecat 9y ago
    There are plenty of instances where websites do not need to use HTTPS No there aren't. like simple static websites for small businesses that do not collect personal user information Until the connection gets MITMed to return a fake login page.
    • gmueckl 9y ago
      What login page? Your typical company website just has a few pages of text without any active elements. Forcing those to buy SSL certificates creates just another artificial barrier to entry.
      • dredmorbius 9y ago
        Whatever login page the attacker wants to present. They're betting percentages. Google. Amazon. sac.mil. fed.gov. Whatevs.
    • throwaway2048 9y ago
      Please tell me a way to enable https for local LAN only devices that does not involve me MITM'ing every connection to them..
    • ksk 9y ago
      This centralizes publishing rights to browser vendors & security cert vendors. I don't want to take permission from any third-party before publishing content on the web. In any case, its rather rude of you to presume to know what people should think about this topic.
  • ridiculous_fish 9y ago
• msie 9y ago
  While were at it: why not define a new Javascript with just the "Good Parts" and then refuse to run old Javascript?
  • bastawhiz 9y ago
    In a way, that's already happening with wasm. I can't wait for a major language VM to be compiled to WASM and hosted on a common CDN (so it's likely to be cached). It's not such a pipe dream to imagine running high performance Python 3 or Java without the overhead of asm.js on the interpreter, but with the ease of running old fashioned JS.
• jgowdy 9y ago
  The people who are pushing back against HTTPS really bug me to be honest. They say silly things like “I don’t care if people see most of my web traffic like when I’m browsing memes.” That presumes that the ONLY goal of HTTPS is to hide the information transferred. However, you have to recognize the fact that you run JITed code from these sites. And we have active examples of third parties (ISPs, WiFi providers) inject code into your web traffic. When browsing the web with HTTP you are downloading remote code, JITing it, and running it on every site you visit if you aren’t 100% noscript with no HTTP exceptions. You have no way of knowing where that code actually came from. Now consider that things like Meltdown and Spectre have JavaScript PoCs. How is this controversial?
  • degenerate 9y ago
    I browse a popular gaming forum that has not implemented HTTPS. Chatting with the admin, the reason is simple: Ads. We can definitely blame the ad networks. Some have switched, but many won't work on https, and websites relying on ad revenue must stay with HTTP or make less money with HTTPS-friendly ad networks.
    • mattacular 9y ago
      Genuinely curious what kind of ads network/system you use that is not fully HTTPS compliant by now?
    • lern_too_spel 9y ago
      Those shady ad networks are going to get blocked by Chrome anyway, even without the HTTPS warning. Good riddance.
    • p49k 9y ago
      This hasn’t been true for at least a year. There is zero difference in ad revenue for HTTP vs HTTPS now. Join any major online community for publishers and ask anyone if you don’t believe me.
  • Silhouette 9y ago
    If this is just a warning, that's one thing. If it becomes a solid block, it means more hassle for everyone running an intranet, and a huge liability for millions of long-lived devices with embedded web servers for browser-based configuration.
• lerie82 9y ago
  In my experience with administrators who "don't care" about whether the traffic is over SSL, it's mostly because they don't know how to implement it and simply don't want to admit it. You wouldn't think this would be the issue but I have implemented this on servers and afterwards I don't hear anything bad about it and in fact have been praised for implementing something so simple. Not naming names here but you know who you are.
• alangpierce 9y ago
  Note that Chrome already describes HTTP sites as "not secure", this change just makes it more prominent. If you click the little circled "i" on any HTTP site, it shows this messsage: > Your connection to this site is not secure > You should not enter any sensitive information on this site (for example, passwords or credit cards), because it could be stolen by attackers.
• to3m 9y ago
  Is there a good reason to require https for localhost?
  • valleyer 9y ago
    Yes: the browser is not in control of resolving "localhost" to 127.0.0.1, nor is it in control of resolving 127.0.0.1 to the loopback interface. These are details the OS is in charge of, not the browser. So the browser can't know that http://localhost/ http://localhost/ is "secure".
• ridiculous_fish 9y ago
  What is the modern simple and cheap way to set up a static HTTPS site with a custom domain? With HTTP this was doable with S3 for pennies a month; is S3+CloudFlare now the current price leader?
  • analogic 9y ago
    netlify
  • AndrewConn 9y ago
    For a static site on AWS, you can easily set up S3 + CloudFront + Route 53 + free certificate from AWS Certificate Manager. My bill is around $1.07 per month.
  • ctw 9y ago
    I use the free tier of Google Cloud Platform's compute engine to run my server. I use Let's Encrypt for HTTPS. My website is totally free.
    • kgdinesh 9y ago
      In that case, your website is one HN post away from getting slash-dotted.
  • krat0sprakhar 9y ago
    Firebase Hosting (Disclosure: I work for Firebase)
  • ridiculous_fish 9y ago
    Replying to myself. It's distressing how many of the options assume command line competence. It used to be that graphic designers, photographers, families, etc. could set up a simple site with a shared host, an FTP client, and a bit of HTML. Now requiring HTTPS will push this further out of reach. This content is now funneled into either managed platforms, either free ones that monetize it (Medium, Flickr, Facebook, etc.) or more expensive higher-touch services (SquareSpace, Wix, etc). The de-democratization of the web continues.
• csjr 9y ago
  If I understand correctly, Chrome shows that "Secure" label on sites using HTTPS. What bothers me is that non technical users will start to trust the same "Secure" label. On phishing, what stops someone from registering a shady domain and securing it w/ Lets Encrypt?
  • Something1234 9y ago
    Chrome should have 3 levels of security. * HTTP (Red Box and Complaining) * HTTPS w/ Let's Encrypt (No compliants, but no true secure lock.) * HTTPS w/ a paid certificate (True magical green box) In fact I think this should apply to all browsers. This might not deal with all of the issues, but it would be a good start. Feel free to point out where I'm wrong.
    • dane-pgp 9y ago
      Will the extra magic of the green box make users more secure? Does paying for a certificate make the certificate more trustworthy? These are actually serious questions that I think the CA/Browser Forum are discussing (particularly in terms of the issuing requirements and UI representation for EV certificates), but I think it often boils down to the "feeling" of security, relying on the supposition that criminals would be less successful if their site didn't have the magical green box, or that they would be easier to catch by tracing the credit card payment they used to buy their certificate.
    • firloop 9y ago
      What makes Let's Encrypt less secure than a paid certificate? Or do you mean EV certs for the "magical green box"?
      • cheeze 9y ago
        Even EV certs don't really matter. Case in point: https://stripe.ian.sh/ https://stripe.ian.sh/ Let's Encrypt isn't the problem here. Expecting all CAs to properly verify what is and isn't a phishing website is unreasonable IMO. It just won't happen. Smaller CAs have hundreds of thousands of certs... it's just not possible. The real issue is that a cert only says "Your communication between this site is encrypted, and you're speaking to the owner of this certificate" (Assuming it hadn't been compromised.) Certs don't make any guarantee that the person you are talking to is a good guy, nor that they aren't trying to trick you into giving your password to them.
• zerostar07 9y ago
  excessive. people will learn to ignore it
• lsc36 9y ago
  Firefox will eventually follow up as well: "To continue to promote the use of HTTPS and properly convey the risks to users, Firefox will eventually display the struck-through lock icon for all pages that don’t use HTTPS, to make clear that they are not secure." [1] [1] https://blog.mozilla.org/security/2017/01/20/communicating-the-dangers-of-non-secure-http/ https://blog.mozilla.org/security/2017/01/20/communicating-t...
• Pxtl 9y ago
  Maybe Android Chrome could be worked on to not poop the bed quite so thoroughly when faced with a captive portal, then, if they're trying to get everybody onto https. Because the interaction between https, Android, and captive portals is just not a good scene.
• yesenadam 9y ago
  Maybe someone could answer this for me, this discussion made me curious: I have an old (2005) Mac, and my fav browser on it can't show https sites at all 90%+ of the time - "Cannot Load, Secure Connection Failed". (like the usual https sites linked to in HN stories) But it works fine with some https sites, e.g. github https, youtube, this page. What is it about those 'working' https sites that makes them different? Hopefully that's enough info to answer that.
  • adamtulinius 9y ago
    Your browser probably only support old ciphers or old versions of TLS.
  • will_hughes 9y ago
    Probably because they support older SSL/TLS versions and/or cryptographic ciphers.
    • yesenadam 9y ago
      Ohh thanks guys. Yeah, I had a vague feeling my SSL (whatever that is) was outdated. So those sites just are more backwards-compatible. (Although github isn't backwards-compatible enough to actually make an account. I tried.)
• karmakaze 9y ago
  This will reduce the diversity of information exchanged, as does ranking secure sites higher in search results. Privacy and security are worthy goals, but I do feel for those who are attempting to publish free information on personally run sites. The easiest thing to do is put Cloudflare in front of them which also has other benefits.
  • karmakaze 9y ago
    Downvoted without comment. I suppose certain topics on HN are only accepted to have a one-sided view.
• standardcitizen 9y ago
  I believe most people are seeing this wrong, there a few issues here. 1) Google is defining standards This isn’t a drive for web masters and users, it’s our brother Google telling us what’s good and what is bad. While they often fail on their own standards. But hey, they can’t fail to pass, but you cant.. no expections besides big G. 2) We’re focusing on SSL This isn’t about SSL, but’s about point one. 3) misleading Reading some basic website that is just a random one page html site, doesn’t care about it at all. This gives basic users( the ones we’re thinking are too dumb to demand ssl) the idea this site is not safe. Real users think two things; Safe or not safe.. they don’t understand the gray and now we’re saying Not Secure. A lot of people will think this is not safe, no one is around telling them why this appears as no one in the real world reads this blog besides us.
• deleted 9y ago
  [deleted]
• gmueckl 9y ago
  As long as this is just a non-obnoxious warning that translates http to something in plain English I can sort of live with it. But as soon as browsers start to inject security warnings, this is going to be very, very bad. Our company manufactures devices for use in labs and industrial processes. They need complex user interfaces and there is a push to move to HTTP, HTML and JS to implement them with the device as the web server. The devices are usually installed in a controlled, isolated internal networks. Our clients run these devices for a long time. 20 or 30 years are not unheard of. They also do not update them if there is no malfunction (they work and our clients love it that way). Now how the hell do we create a webserver that will work reliably for the next 30 years if we have to embed SSL certificates with built-in expiration dates in the range of 1 to 3 years?
  • frozenport 9y ago
    Do you also expect HTML or JS to be stable for 30 years?
  • jonny_eh 9y ago
    Self-sign the certs that expire in 1000 years, then add them to the clients.
    • dragonwriter 9y ago
      Don't browsers automatically distrust certificates with a lifespan longer than the current maximum (825 days)?
  • xtrapolate 9y ago
    Now how the hell do we create a webserver that will work reliably for the next 30 years if we have to embed SSL certificates with built-in expiration dates in the range of 1 to 3 years? You can use self-signed certificates. Your clients will have to trust them (by updating their stores). That's hardly an ideal solution (deployment and security wise). More broadly speaking, you can't rely on anything to stay the same in 30 years, in terms of infrastructure. Many companies therefore deliver both the devices themselves, as-well as the systems to control them (ie. custom laptops/tablets). More costly for everyone involved.
• dawnerd 9y ago
  As long as it doesn't break local development again like their forcing of https on *.dev even when locally hostfiled. Funny enough they suggest using .test which is fine, except you cant use .test as a callback url when setting up googles oauth... fail!
• cocktailpeanuts 9y ago
  Probably will be a very unpopular opinion, but while I appreciate that HTTPS encrypts traffic, I do think a mandatory HTTPS usage comes with a cost, not so much mentioned in this thread. Here's what I think: I think the mandatory usage of HTTPS centralizes the already centralized web even further. HTTPS itself is secure theoretically, but at the same time it relies on: 1. Trust in browser vendors: Basically the way HTTPS works currently is that all browsers have "trusted certificate sources" hardcoded. And there aren't that many browsers out there with meaningful market share--Chrome, Firefox, Edge, Safari, and that's about it (One may even say it's pretty much Chrome all the way, with rest of them trailing far back) 2. Trust in the certificate authorities: The way HTTPS works relies on "trusted certificate sources", like verisign. This was already way too centralized, but it will become even more so. I'm guessing eventually companies like Google or Apple will start acting as generic certificate authorities (as a verisign competitor) unless regulators cut in. If you think about the implication of all this, the more we move towards an "HTTPS first world", the more power these entities will have and the more damage it will cause when one of them gets compromised. Note that the web has never been forced to use HTTPS throughout its entire history, so we have no idea how this will play out and I'm just speculating based on my knowledge. HTTPS itself is secure, but as a lot of you know, most dangerous hacks come not from exploiting tech flaws, but by exploiting the weakest link in the value chain--the human factor. And when things become this centralized, the "human factor risk" becomes larger and larger. We have never before had a world where HTTPS was forced, so it's not easy to just visualize this or predict what will happen, but I can imagine there can be many ways the "The entire web can go down one day" because of the extreme centralization, and when I say "the entire web" I mean it literally. One day, some hacker will take advantage of the extremely centralized landscape of the web and probably be able to compromise the ENTIRE web, and you won't be able to browse the web all day, until Apple, Mozilla, or Google releases a security update. This will be way worse than what we've experienced with S3 going down, because it will obsolete security measures of ALL web browsers in one fell swoop. Another thing I don't like about this "forced HTTPS" is that mandatory HTTPS makes it difficult to publish stuff to the web. You must either deploy your own Letsencrypt to run your website, or if it's too much of a hassle (which would be the case for most people, even developers), just run your website on a service provider that already has HTTPS. This means people will rather publish their blogs on sites like medium.com rather than running their own wordpress server, or even a ghost blog. And when this happens, where do you think people will flock to? Most people will flock to platforms that are most stable and have high reputation, such as Google, Facebook, etc., which will centralize the web even further. I may sound like a tin foil hat conspiracy theory guy but I just wanted to share my thought since everyone seems to think "You must be fucking crazy moron to think that there can be some drawbacks with a forced HTTPS future". Google does have every interest to move the web this direction because they already own the "centralized web", and the more centralized it becomes the more they benefit. Just to reiterate, I do think HTTPS is great, and user privacy should be respected. I am just providing an alternative opinion.
• jasonkester 9y ago
  Terrible news. So much work for so many people to update so many old websites that will see absolutely zero benefit from serving content via ssl. I have an old travel blogging site with a few hundred thousand posts in read only mode. Thinking about how much work it was to upgrade my other sites to https, chase down and work around every http request in the code base, purchase and install certs for silly things like cloudfront that you wouldn't think would suck away two days of your life. I'll probably just let the site die in July. It doesn't make money, so it's going to be a tough decision whether to dump thousands of dollars of otherwise billable time into upgrading it to accommodate google's silly whim.
  • Jonnax 9y ago
    Why not just spin up a HAproxy container and so SSL termination on it? Let's Encrypt also do free certificates. There's no reason to pay for one.
    • swvjeff 9y ago
      A lot of these older sites are probably on old servers that LE doesn't support, making it a little less than trivial.
      • EADGBE 9y ago
        This! When I was on a cheap shared and hosted solution the idea of LE was waaayyy above me. But, I moved over everything to AWS, for the same amount of money (OK, ~$0.60 more than what I was paying before - relatively nothing), and it became a piece of cake. That initial time commitment to the move, though, will never be recouped. I do however look at it as a career-expanding experience (fairly confident in how AWS works for projects/companies), so I got that going for it.
  • nickw444 9y ago
    You could always consider a free service like Cloudflare which can sit in front of your site and serve the site via SSL to your customers. Yes, it's still unencrypted between CF and your site, however it would resolve the poor "insecure" UX. As a bonus, CF also has functionality that can re-write http uri's to https.
• LoSboccacc 9y ago
  Now that we're done conflating encryption with certificates and cheapened the meaning of certificate trust, what are we going to use to establish which entity actually controls the domain name we are pointed to?
• pleasecalllater 9y ago
  So suddenly people will see lots of websites as insecure. This way they will stop paying attention to this warning, and when they will find a really insecure website, they will just use it.
• mroy_q 9y ago
  the most interesting thing is that i know some Organ, not only inject code , may catch all Data !! if the web is not use a save version SSL, - .-
• turrini 9y ago
  It's very simple: with HTTP, ISPs can see your traffic and direct target ads to you. If everything is under HTTPS, they will need to resort to Google for ads since almost everyone uses Google Search Engine and it's products.
  • cup-of-tea 9y ago
    Yep. This is about Google maintaining their monopoly on your data and nothing else.
• krishani 9y ago
  I feel its a good thing. Sites can be made HTTPS with letsencrypt.
  • mmphosis 9y ago
    https://letsencrypt.org/getting-started/ https://letsencrypt.org/getting-started/ With Shell Access and automatic renewal, what could possibly go wrong? What happens to all the web sites if the Let's Encrypt certificates, one day, expire?
    • dredmorbius 9y ago
      One of the things about well-known SPOFs is you try really, really, REALLY hard to make sure they don't F.
• usermac 9y ago
  I hate this. I too do a lot of off-line, never connected to the Internet devices and I don't want the god Google telling my users they're "not secure". My users know they're on a self contained network.
• nautilus12 9y ago
  What about simple static sites like blogs that dont have forms? Do we really need to scare people away from our blogs and do we have to get an SSL cert for them unecessarily?
  • SquareWheel 9y ago
    This has already been answered many times in this thread. Static sites are still vulnerable to MITM attacks and snooping over the network. Using HTTPS prevents this.
• vectorEQ 9y ago
  dick move. not all sites require https. it's easy to analyse in browser if a site needs https and flag that as insecure, which they already do... :s
• staticelf 9y ago
  I do not like this. I host a website on my dads shop which is not TLS-secured. Why? It's just a one page static site with some info about his store. There is simply no need to encrypt that. I do not store cookies or host any fishy javascript. Now I basically have to buy a certificate for that small site that has like 60 visitors a week? Not really nice.
• siteshwar 9y ago
  This is going to be interesting. I believe instead of pushing everyone to use https this will cause an average user to start ignoring the security warning. I see the security warning as a way to reflect what's insecure and not a catalyst to move to more secure methods.
• daveheq 9y ago
  Great, way to unnecessarily scare the undereducated masses. Even if they learn, it's pointless, you can already see if it's secure.
• minibob 9y ago
  this is bad idea because many sites doesn't to be httpsed https://downloadidm99.blogspot.com/ https://downloadidm99.blogspot.com/
• donarb 9y ago
  I can see GoDaddy now rubbing their hands with glee as they ponder the prospect of selling overpriced server certificates to unaware website owners. No way they'll push a Let's Encrypt solution.
  • josefresco 9y ago
    This. I already have clients purchasing SSL certificates from GoDaddy due to their aggressive FUD-marketing. To make matters even worse, GD does not in any way assist in the installation, or "activated" of the SSL cert.
    • LambdaComplex 9y ago
      I just checked GoDaddy's prices, out of curiosity. "Plans starting at $59.99/yr". For comparison, you can get a Comodo PositiveSSL cert for about $10/yr.
• deleted 9y ago
  [deleted]
• greendestiny_re 9y ago
  I don't appreciate Google leveraging its market share to affect the mindset of Chrome users.
  • dredmorbius 9y ago
    I bitch plenty about Google. I'm happy with them trying to swing the needle to the side of good every once in a while.
• nannePOPI 9y ago
  Looks like defamation to me. Just because a website doesn't have https doesn't mean it not secure. It's not secure for some activities, and if the browser marks the whole page as not secure, it's defamation. I don't care if the web would be better with all site having https. Chrome is saying something defamatory about websites without https.
• bartl 9y ago
  It's insane. I can't even access the web interface of my own printer any more, because it's not https.
  • pas 9y ago
    No, it's not. Yes, you can. Or if you can't, it's not because this change.
• imhelpingu 9y ago
  How about I just give Google an SSH cert for my router and then they can proactively monitor my entire network to make sure I'm not being MITM'ed.
• lousken 9y ago
  So the next thing is to disable all javascript loaded without https I hope.
• imhelpingu 9y ago
  In ten years: "To further protect our passengers, Alphabet OS cars will no longer be manually navigable down unmarked roads either."
• bernardino 9y ago
  What are the best services out there today to translate a website from HTTP to HTTPS? Particularly for a static website. I have previously used Cloudfare's One-Click SSL free service, and I wasn't a big fan.
  • andscoop 9y ago
    Netlify free tier makes this as simple as it gets. (As long as your static site generator is supported.)
• collyw 9y ago
  Google.es was on http until pretty recently. They change the rules now that the finally put it on https.