17 ms·

I'm glad this is happening, although I'm more excited for the day when they start very obviously marking password input fields as "NOT SECURE" when they are use

I'm glad this is happening, although I'm more excited for the day when they start very obviously marking password input fields as "NOT SECURE" when they are used on HTTP sites. Although I am genuinely surprised how much Google and others like Mozilla have had to drag many site owners kicking and screaming into HTTPS. I never would have imagined that end-to-end encryption by default would be consitered "controversial". Also, those HTTPS numbers are amazing! * Over 68% of Chrome traffic on both Android and Windows is now protected * Over 78% of Chrome traffic on both Chrome OS and Mac is now protected * 81 of the top 100 sites on the web use HTTPS by default

deleted 9y ago
[deleted]
Santosh83 9y ago
>I'm glad this is happening, although I'm more excited for the day when they start very obviously marking password input fields as "NOT SECURE" when they are used on HTTP sites. Mozilla already does this with Firefox: https://support.mozilla.org/en-US/kb/insecure-password-warning-firefox?as=u&utm_source=inproduct https://support.mozilla.org/en-US/kb/insecure-password-warni...
- schoen 9y ago
  Maybe Klathmon was envisioning it appearing inside the password field itself (not just in the browser chrome)?
  - Ajedi32 9y ago
    Firefox _does_ do it in the password field itself: https://prod-cdn.sumo.mozilla.net/uploads/gallery/images/2017-04-21-23-52-53-ba340d.png https://prod-cdn.sumo.mozilla.net/uploads/gallery/images/201... Doesn't seem like Chrome's planning to do it that way though.
    - schoen 9y ago
      Oh yeah, thanks for pointing that out! Maybe Chrome would be up for it at some point in the future as HTTP form submissions become rarer, though I don't know how they made this decision. Edit: Amusingly, even though I normally use Firefox, I haven't noticed this UI element recently because I'm so conscious of HTTPS—working on Let's Encrypt and support for it—that I rarely even try to enter information into a non-HTTPS site in the first place. :-) (so I might not be quite the target audience for this notification)
pjmlp 9y ago
I am glad, but it also pisses me off. Computer goes out of sync with some kind of cache server, welcome to HSTS errors and not able to surf to any site with cached content there. Visit customers that have self signed certificates on their guest network, hello LTE to be able to do anything.
- Klathmon 9y ago
  To be completely honest, this kind of counter-argument (not that you are advocating against HTTPS, but bear with we) always reads to me like "people forget passwords, and don't like having to type usernames, so we just rely on the honor system". Yes, security has downsides, but in my opinion those downsides are well worth it for the benefits.
  - AnIdiotOnTheNet 9y ago
    That very much depends on the circumstances doesn't it?
  - badsectoracula 9y ago
    Personally i wouldn't mind it that much if the browser let me bypass the error but HSTS seems to mean "even if the site would work fine otherwise, keep it broken". There have been several cases where i couldn't bypass such an error in a site that i just wanted to read something and i was very surprised to see that Firefox didn't had any about:config option to indicate that "i know what i am doing, let me in". So much for taking back the web. Seems it was only temporary so we can hand it to Google.
    - ancarda 9y ago
      If browsers allowed you to bypass HSTS, then it could be easily defeated by an attacker by breaking the traffic on port 443, forcing the user to disable SSL for the site. What would be the point over regular SSL? HSTS was designed as a response to programs like sslstrip, where the implementation of SSL may be attacked so the user is made vulnerable. If a website puts out an HSTS header, they are telling the browser they need a higher bar of security than regular SSL.
m_eiman 9y ago
Required maintenance for a simple, static http site: none. Required maintenance for a simple, static https site: configure let’s encrypt and keep the cron job running. Big difference? Not for some, but it sure is something that offers very little value for very many site owners. Even the top 100 sites are only at 80% https by default, and they do it for a living!
- AstralStorm 9y ago
  A server is not a site.
- JankySolutions 9y ago
  Required maintenance for a simple, static https site: Install certbot, press enter a few times, forget about it. "keep a cron job running" sounds like it you're running the cron job by hand. >Even the top 100 sites are only at 80% https by default, and they do it for a living! That's entirely separate from your "simple, static site" example and yes, rolling any sort of large change out to a big site is a big deal, and if there isn't business motivation to do it it likely wont happen. Google is providing everyone a business motivation by threatening to point out to users that insecure sites are insecure.
  - dfabulich 9y ago
    > "keep a cron job running" sounds like it you're running the cron job by hand. Cron jobs fail sometimes. You have to monitor them, investigate why they failed, fix the issue, and rerun them. Web servers fail, too, but with shared hosting, it's mostly not your problem. And shared hosting providers are still trying to charge an arm and a leg to manage SSL certs for you (because it's a nice high-margin business for them).
    - tokenizerrr 9y ago
      1. You don't have to monitor your cronjobs. They'll send you an email when they produce output. 2. Let's Encrypt will send you an email if your certificate is going to expire in a month. This will normally never happen, since it is continuously renewed.
badsectoracula 9y ago
> Although I am genuinely surprised how much Google and others like Mozilla have had to drag many site owners kicking and screaming into HTTPS Personally i am very concerned about how much power Google has over the web - all it takes to change millions of how web sites work and look like is a random decision by Google. What bothers me even more is that most people do not seem to care much because they happen to agree with what Google is doing (so far). However i think that sites should make decisions on their configuration, layout, mobile friendliness and other things because they want to, not because they are forced by Google through taking advantage of their position and biasing what people see towards what they believe people should see. I do not like that Google basically dictates how the web should behave. (actually it isn't only the web, but also mail - just recently i had a mail of mine end up in the spam folder of someone else's GMail account because who knows what of the 1983847813 things i didn't configured exactly as Google likes it in my mail server... and of course the "solution" that many people present to this is to hand all my communications to Google)
- Avamander 9y ago
  > 1983847813 things And by that you mean?
  - trav4225 9y ago
    Probably the dozens of various DNS, DKIM, SPF, SMTP behavior config, non-consumer-IP, etc., etc. boxes that must be ticked just right in order to not be considered a spammer these days. It's very difficult to get it all correct enough to keep a significant portion of the email sent through your SMTP site from being considered spam by mainstream email providers such as Google.
    - agentdrtran 9y ago
      yeah, but all of these things exist becuase of the sheer amount of spam that gets sent to people.
      - 9y ago
saas_co_de 9y ago
> I never would have imagined that end-to-end encryption by default would be consitered "controversial" The whole point of Google's https crusade is to secure users from ISPs profiling their browsing activity, which for them is about eliminating the competition because they still monitor and track everyone and so if they knock the ISPs out they solidify their monopoly position. HTTPS is not bad but Google's motives (in the context of their business model and monopoly position) are and that gives some people pause.
- adtac 9y ago
  Wow, I'm genuinely surprised someone managed to spin something like Google advocating for a secure web into a monopoly agenda. I get it, corporations are evil. But not every move. Why can't this simply be something out of goodwill?
  - josteink 9y ago
    > I'm genuinely surprised someone managed to spin something like Google advocating for a secure web into a monopoly agenda You are surprised to see people expecting more monopolistic behavior from the biggest monopolist on the web? I have bridges for you.
    - wpietri 9y ago
      I don't think this needs to be seen as a monopoly move. Think of it instead like health inspections for restaurants. In theory, restaurateurs would hate health inspections, because they're intrusive regulation with no direct benefit. But they have a lot of indirect benefit, in that the safer people feel going to restaurants, the more likely they are to go out to eat. Similarly, the safer the web is, the better off Google is, because people do more things on the web. That does benefit them, sure, but I don't think it benefits them disproportionately, let alone harms other legitimate competitors.
      - indubitable 9y ago
        Source on people eat out more when there are health inspections? I've lived and traveled to many countries where there are no meaningful food inspections whatsoever, and your statement there really does not pass the sniff test. And as an aside there also tend to be far more independent restaurants since if you can cook something well, then all you need do is plop out a table, put up a sign, and you're in business.
stevenicr 9y ago
"obviously marking password input fields as "NOT SECURE"" - firefox has been doing this for a while, confuses some of my users - I am glad it's there, but wish it did not completely cover the login button on wordpress fields. Very glad there is a "learn more" attached to this. "Google and others like Mozilla have had to drag many site owners kicking and screaming" - I was dragged into this by the Google threats. Spent hours on it. Come to find our most popular few pages use a script that just will not function over https - no way to make it happen. Then I spent hours crafting htaccess rules to make some pages https (home and password pages) - and some pages forced non-https (the 5 pages we have with needed chat script on them) - more hours into updating links on all pages and everything - then come to find out the browsers have a function where if your home page is https only then it can't pull the sub pages as non-https (maybe it's the other way around, it's been a while) - So I had to go and undo all the changes. I've been spending time trying to help develop newer chat scripts to have all the functionality of the old one our users prefer - and to no avail. So as google forces https use on sites to be in it's results, and now to not be labeled as insecure - we currently have to choose to remove our most popular functions on our site or lose the google battle completely. We are still trying to get a newer chat system up and running that has our old familiar functions, but we don't have the resources that google and others have obviously. We want https so bad, we love, love, love more encryption the better. It just has not been an easy thing for us to implement, and we've tried many things, included pushing our users to newer html5 based chat systems and such. Nothing has panned out quite yet. Fingers crossed we make strides in these areas before it gets worse.
- heywire 9y ago
  No offense, but this can't have come as a surprise. The writing has been on the wall for a very long time. I'm glad that Google is forcing company's hands here, because it is obvious that if they didn't, some would never "find time" to get it done.
- heartbreak 9y ago
  You may want to update the website linked via your HN profile as well. To start with, every page includes unicode replacement characters mixed into the text.
zerostar07 9y ago
it's not end-to-end encryption. it's end-to-end with a middleman issuing cerificates who's not trustless.
deleted 9y ago
[deleted]
btym 9y ago
>81 of the top 100 sites on the web use HTTPS by default I find it disappointing that there are any sites that large that are using HTTP.
dx034 9y ago
I'm actually quite shocked that 19 of the top 100 pages still use http by default. For small or internal pages that's fine but top 100 pages on the internet? Any idea which pages they're talking about?
- tialaramex 9y ago
  Google's Transparency Report shows a list of which top sites do modern HTTPS by default, which do it but only if you explicitly request the HTTPS site, and which have crappy (e.g. TLS 1.0 only, or they require 3DES) cryptography, and which have nothing at all. https://transparencyreport.google.com/https/top-sites https://transparencyreport.google.com/https/top-sites The last category features many Chinese sites. I could speculate about why that is, maybe the Great Firewall gives citizens no reason to bother trying to achieve security, maybe Chinese culture opposes privacy, maybe everybody in China is running Windows 95 still. But whatever the reason, that's an observable fact. There's also a whole bunch of crappy British tabloid newspapers there. Given their print editions are specifically printed on the worst quality paper that will take print ink, and they are routinely accused of "gutter" journalism, perhaps it isn't a surprise that defending their reputations through the use of encryption isn't a priority? Or you know, maybe British culture... British great firewall... etcetera. No idea.

deleted 9y ago

[deleted]

Santosh83 9y ago

>I'm glad this is happening, although I'm more excited for the day when they start very obviously marking password input fields as "NOT SECURE" when they are used on HTTP sites. Mozilla already does this with Firefox: https://support.mozilla.org/en-US/kb/insecure-password-warning-firefox?as=u&utm_source=inproduct https://support.mozilla.org/en-US/kb/insecure-password-warni...

schoen 9y ago
Maybe Klathmon was envisioning it appearing inside the password field itself (not just in the browser chrome)?
- Ajedi32 9y ago
  Firefox _does_ do it in the password field itself: https://prod-cdn.sumo.mozilla.net/uploads/gallery/images/2017-04-21-23-52-53-ba340d.png https://prod-cdn.sumo.mozilla.net/uploads/gallery/images/201... Doesn't seem like Chrome's planning to do it that way though.
  - schoen 9y ago
    Oh yeah, thanks for pointing that out! Maybe Chrome would be up for it at some point in the future as HTTP form submissions become rarer, though I don't know how they made this decision. Edit: Amusingly, even though I normally use Firefox, I haven't noticed this UI element recently because I'm so conscious of HTTPS—working on Let's Encrypt and support for it—that I rarely even try to enter information into a non-HTTPS site in the first place. :-) (so I might not be quite the target audience for this notification)

pjmlp 9y ago

I am glad, but it also pisses me off. Computer goes out of sync with some kind of cache server, welcome to HSTS errors and not able to surf to any site with cached content there. Visit customers that have self signed certificates on their guest network, hello LTE to be able to do anything.

Klathmon 9y ago
To be completely honest, this kind of counter-argument (not that you are advocating against HTTPS, but bear with we) always reads to me like "people forget passwords, and don't like having to type usernames, so we just rely on the honor system". Yes, security has downsides, but in my opinion those downsides are well worth it for the benefits.
- AnIdiotOnTheNet 9y ago
  That very much depends on the circumstances doesn't it?
- badsectoracula 9y ago
  Personally i wouldn't mind it that much if the browser let me bypass the error but HSTS seems to mean "even if the site would work fine otherwise, keep it broken". There have been several cases where i couldn't bypass such an error in a site that i just wanted to read something and i was very surprised to see that Firefox didn't had any about:config option to indicate that "i know what i am doing, let me in". So much for taking back the web. Seems it was only temporary so we can hand it to Google.
  - ancarda 9y ago
    If browsers allowed you to bypass HSTS, then it could be easily defeated by an attacker by breaking the traffic on port 443, forcing the user to disable SSL for the site. What would be the point over regular SSL? HSTS was designed as a response to programs like sslstrip, where the implementation of SSL may be attacked so the user is made vulnerable. If a website puts out an HSTS header, they are telling the browser they need a higher bar of security than regular SSL.

m_eiman 9y ago

Required maintenance for a simple, static http site: none. Required maintenance for a simple, static https site: configure let’s encrypt and keep the cron job running. Big difference? Not for some, but it sure is something that offers very little value for very many site owners. Even the top 100 sites are only at 80% https by default, and they do it for a living!

AstralStorm 9y ago
A server is not a site.
JankySolutions 9y ago
Required maintenance for a simple, static https site: Install certbot, press enter a few times, forget about it. "keep a cron job running" sounds like it you're running the cron job by hand. >Even the top 100 sites are only at 80% https by default, and they do it for a living! That's entirely separate from your "simple, static site" example and yes, rolling any sort of large change out to a big site is a big deal, and if there isn't business motivation to do it it likely wont happen. Google is providing everyone a business motivation by threatening to point out to users that insecure sites are insecure.
- dfabulich 9y ago
  > "keep a cron job running" sounds like it you're running the cron job by hand. Cron jobs fail sometimes. You have to monitor them, investigate why they failed, fix the issue, and rerun them. Web servers fail, too, but with shared hosting, it's mostly not your problem. And shared hosting providers are still trying to charge an arm and a leg to manage SSL certs for you (because it's a nice high-margin business for them).
  - tokenizerrr 9y ago
    1. You don't have to monitor your cronjobs. They'll send you an email when they produce output. 2. Let's Encrypt will send you an email if your certificate is going to expire in a month. This will normally never happen, since it is continuously renewed.

badsectoracula 9y ago

> Although I am genuinely surprised how much Google and others like Mozilla have had to drag many site owners kicking and screaming into HTTPS Personally i am very concerned about how much power Google has over the web - all it takes to change millions of how web sites work and look like is a random decision by Google. What bothers me even more is that most people do not seem to care much because they happen to agree with what Google is doing (so far). However i think that sites should make decisions on their configuration, layout, mobile friendliness and other things because they want to, not because they are forced by Google through taking advantage of their position and biasing what people see towards what they believe people should see. I do not like that Google basically dictates how the web should behave. (actually it isn't only the web, but also mail - just recently i had a mail of mine end up in the spam folder of someone else's GMail account because who knows what of the 1983847813 things i didn't configured exactly as Google likes it in my mail server... and of course the "solution" that many people present to this is to hand all my communications to Google)

Avamander 9y ago
> 1983847813 things And by that you mean?
- trav4225 9y ago
  Probably the dozens of various DNS, DKIM, SPF, SMTP behavior config, non-consumer-IP, etc., etc. boxes that must be ticked just right in order to not be considered a spammer these days. It's very difficult to get it all correct enough to keep a significant portion of the email sent through your SMTP site from being considered spam by mainstream email providers such as Google.
  - agentdrtran 9y ago
    yeah, but all of these things exist becuase of the sheer amount of spam that gets sent to people.
    - 9y ago

saas_co_de 9y ago

> I never would have imagined that end-to-end encryption by default would be consitered "controversial" The whole point of Google's https crusade is to secure users from ISPs profiling their browsing activity, which for them is about eliminating the competition because they still monitor and track everyone and so if they knock the ISPs out they solidify their monopoly position. HTTPS is not bad but Google's motives (in the context of their business model and monopoly position) are and that gives some people pause.

adtac 9y ago
Wow, I'm genuinely surprised someone managed to spin something like Google advocating for a secure web into a monopoly agenda. I get it, corporations are evil. But not every move. Why can't this simply be something out of goodwill?
- josteink 9y ago
  > I'm genuinely surprised someone managed to spin something like Google advocating for a secure web into a monopoly agenda You are surprised to see people expecting more monopolistic behavior from the biggest monopolist on the web? I have bridges for you.
  - wpietri 9y ago
    I don't think this needs to be seen as a monopoly move. Think of it instead like health inspections for restaurants. In theory, restaurateurs would hate health inspections, because they're intrusive regulation with no direct benefit. But they have a lot of indirect benefit, in that the safer people feel going to restaurants, the more likely they are to go out to eat. Similarly, the safer the web is, the better off Google is, because people do more things on the web. That does benefit them, sure, but I don't think it benefits them disproportionately, let alone harms other legitimate competitors.
    - indubitable 9y ago
      Source on people eat out more when there are health inspections? I've lived and traveled to many countries where there are no meaningful food inspections whatsoever, and your statement there really does not pass the sniff test. And as an aside there also tend to be far more independent restaurants since if you can cook something well, then all you need do is plop out a table, put up a sign, and you're in business.

stevenicr 9y ago

"obviously marking password input fields as "NOT SECURE"" - firefox has been doing this for a while, confuses some of my users - I am glad it's there, but wish it did not completely cover the login button on wordpress fields. Very glad there is a "learn more" attached to this. "Google and others like Mozilla have had to drag many site owners kicking and screaming" - I was dragged into this by the Google threats. Spent hours on it. Come to find our most popular few pages use a script that just will not function over https - no way to make it happen. Then I spent hours crafting htaccess rules to make some pages https (home and password pages) - and some pages forced non-https (the 5 pages we have with needed chat script on them) - more hours into updating links on all pages and everything - then come to find out the browsers have a function where if your home page is https only then it can't pull the sub pages as non-https (maybe it's the other way around, it's been a while) - So I had to go and undo all the changes. I've been spending time trying to help develop newer chat scripts to have all the functionality of the old one our users prefer - and to no avail. So as google forces https use on sites to be in it's results, and now to not be labeled as insecure - we currently have to choose to remove our most popular functions on our site or lose the google battle completely. We are still trying to get a newer chat system up and running that has our old familiar functions, but we don't have the resources that google and others have obviously. We want https so bad, we love, love, love more encryption the better. It just has not been an easy thing for us to implement, and we've tried many things, included pushing our users to newer html5 based chat systems and such. Nothing has panned out quite yet. Fingers crossed we make strides in these areas before it gets worse.

heywire 9y ago
No offense, but this can't have come as a surprise. The writing has been on the wall for a very long time. I'm glad that Google is forcing company's hands here, because it is obvious that if they didn't, some would never "find time" to get it done.
heartbreak 9y ago
You may want to update the website linked via your HN profile as well. To start with, every page includes unicode replacement characters mixed into the text.

zerostar07 9y ago

it's not end-to-end encryption. it's end-to-end with a middleman issuing cerificates who's not trustless.

deleted 9y ago

[deleted]

btym 9y ago

>81 of the top 100 sites on the web use HTTPS by default I find it disappointing that there are any sites that large that are using HTTP.

dx034 9y ago

I'm actually quite shocked that 19 of the top 100 pages still use http by default. For small or internal pages that's fine but top 100 pages on the internet? Any idea which pages they're talking about?

tialaramex 9y ago
Google's Transparency Report shows a list of which top sites do modern HTTPS by default, which do it but only if you explicitly request the HTTPS site, and which have crappy (e.g. TLS 1.0 only, or they require 3DES) cryptography, and which have nothing at all. https://transparencyreport.google.com/https/top-sites https://transparencyreport.google.com/https/top-sites The last category features many Chinese sites. I could speculate about why that is, maybe the Great Firewall gives citizens no reason to bother trying to achieve security, maybe Chinese culture opposes privacy, maybe everybody in China is running Windows 95 still. But whatever the reason, that's an observable fact. There's also a whole bunch of crappy British tabloid newspapers there. Given their print editions are specifically printed on the worst quality paper that will take print ink, and they are routinely accused of "gutter" journalism, perhaps it isn't a surprise that defending their reputations through the use of encryption isn't a priority? Or you know, maybe British culture... British great firewall... etcetera. No idea.