11 ms·
Chrome will mark all HTTP sites as ‘not secure’ starting in July
- ksri 8y agoIs this also true for localhost, or does localhost get special treatment? What is a good way to get https certificates for localhost other than self signed certificates?
- marcosdumay 8y agoAdding a CA to the local register. Or simply registering one on the browser.
- BrowncoatShadow 8y agohttps://github.com/FiloSottile/mkcert https://github.com/FiloSottile/mkcert Still self-signed, but generates a CA that gets added to your browser. It is all pretty seamless.
- deleted 8y ago[deleted]
- steve19 8y agoIs there any downside to using this to secure local servers with non TLD domains such as server.local?
- criddell 8y agoWill it cause a problem for you if your browser displays gray text saying your connection to localhost is not secure?
- tialaramex 8y agoThis isn't true for localhost. But some browsers don't know whether "localhost" is really localhost, so for best compatibility write 127.0.0.1 or ::1 as appropriate If you need to simulate HTTPS for your local host, but you actually control all the moving parts (e.g. a dev environment) you can use any private key + associated certificate for a DNS FQDN you control, then use /etc/hosts or its moral equivalent to tell your local machine that this name is on the local loop, and the key + certificate will validate. You must not ship this as a "product" because when you do that all the end users end up with the private key, which both destroys the whole _point_ of public key cryptography AND violates the terms of whichever CA issued you with the certificate.
- stefan_ 8y agoSo, what is the Chromes team solution for local network devices like routers? Proxy it over the manufacturers server for a complete loss of any privacy and security, but hey, there is a green check mark then?
- deleted 8y ago[deleted]
- craftyguy 8y agodo many routers not support https for their config pages? if so, that's terrible on their part, get a new router. If they do, then accept the cert in your browser and move on.
- jdlyga 8y agoThe Ubiquity routers use a self signed certificate, which Chrome already marks as insecure. There's ways to change it to use Let's Encrypt though.
- freeone3000 8y agoAdding this cert to your trusted certs file marks it as secure, even if self-signed. This is better than usual.
- ktsmith 8y agoMost consumer routers use self signed certificates which will be marked as insecure by the browser.
- wildpeaks 8y agoIf you wonder how to get HTTPS for your local virtual hosts: 1. create a local CA 2. create a certificate using that local CA 3. Then you can add the CA in your trusted authorities (Firefox does need an extra step: either enable the "security.enterprise_roots.enabled" flag, either import the CA certificate manually in it). Details at: https://gist.github.com/cecilemuller/9492b848eb8fe46d462abeb26656c4f8 https://gist.github.com/cecilemuller/9492b848eb8fe46d462abeb...
- LeoPanthera 8y agoI found this script to manage your local CA: https://github.com/FiloSottile/mkcert https://github.com/FiloSottile/mkcert
- compuguy 8y agoYou can also use the good old EASY-RSA: https://github.com/OpenVPN/easy-rsa https://github.com/OpenVPN/easy-rsa
- Spivak 8y agoDon't get me wrong, using easy-rsa is definitely easier than not but it doesn't abstract nearly as much as a tool for local development probably should which mkcert definitely provides.
- meta_AU 8y agoThe other option is to register a domain and use that to get either LetsEncrypt cetts or purchase a wildcard.
- xienze 8y agoThat’s what I do. And LE actually supports wildcards, so that’s no problem. If your local network is firewalled off LE can still issue you a cert so long as you use DNS record validation.
- bowlich 8y agoBecause my statically generated blog really needs https. This is really going to create an additional layer of inconvenience for people who just want to drop some html documents in an ftp folder and be done with it.
- robin_reala 8y agoBut your static blog isn’t secure served over HTTP. And that’s fine if you choose it.
- skolemtotem 8y agoOh no, someone's going to MITM my shitty blog posts. "Secure" is a word that only makes sense with context, and without that context it only serves to cause irrational panic. I wonder why Google's really doing this.
- UncleMeat 8y agoYes. They literally will. ISPs have injected ads into pages delivered to their customers. Data integrity also comes from HTTPS too.
- patmcguire 8y agoBoxing out ISPs is probably a large part of why they're doing it. Google believes traffic should be able to go directly from your computer to the server in question and then load up Adsense without any interference from your ISP injecting ads. They can do things for more than one reason, it's a good thing, but it also nullifies one of the few channels they don't have access to.
- LeoPanthera 8y agoYou may not care if bad actors inject crap into your web page, but I care, as may many of your readers. This is not a theoretical vulnerability. Comcast routinely adds stuff to unencrypted web pages.
- 8y ago
- segmondy 8y agoWe should mark all sites serving Google ads as "spying on you"
- some_account 8y agoSo true. Google is a two-faced little bastard but people love them. It's a mystery.
- dang 8y agoPlease don't post unsubstantive comments here.
- Jitnaught 8y agoIs there an alternative ad network that doesn't spy on users?
- sjapkee 8y agoThere is no need in ad network at all.
- tbyehl 8y agoThe last GDPR preferences link I clicked on showed nearly 100 companies potentially spying on me. Google is barely the tip of the iceberg.
- amanzi 8y agoTrue - I'm more worried about the privacy intrusions from advertising networks than I am for MITM attacks.
- jcoffland 8y agoI wish Chrome would make an exception for pages on localhost and devices on the local network. There are currently no good solutions for acquiring certificates in these cases.
- tialaramex 8y agoLocalhost already is an exception. For best browser compatibility use either 127.0.0.1 or ::1 as appropriate rather than the name localhost. The browser has no realistic way to conclude that your "local" network is secure. It probably isn't. So there's no sane policy that says that's OK
- dragonwriter 8y agoThey aren't using the “faulty TLS” block page that requires work to get around, just an address bar “not secure” message. If you are using localhost (or other HTTP instead of HTTPS site intentionally, it's not going to cause any problems.)
- josefresco 8y agoThis is a small signal change, most users won't notice. See the example image: https://3.bp.blogspot.com/-pcT-gkZb6OA/WnyBrJKufcI/AAAAAAAAAkM/Xojd1GDFbsgwc6ZhZnNjdOFKXeZ_JlMtACLcBGAs/s640/Treatment%2Bof%2BHTTP%2BPages%25401x.png https://3.bp.blogspot.com/-pcT-gkZb6OA/WnyBrJKufcI/AAAAAAAAA...
- linuxftw 8y agoAll traffic encrypted means no one can see your outbound transmission data, including you! No way to verify what you're sending on the wire if the application is proprietary (and statically compiled) without dumping memory, which would be quite odious.
- dullgiulio 8y agoNo, developer tools.
- UncleMeat 8y ago... You own the client. You can watch the traffic in the browser before it is encrypted.
- detaro 8y agoprevious discussion of source: https://news.ycombinator.com/item?id=16334241 https://news.ycombinator.com/item?id=16334241 (806 points, 814 comments)
- johnp_ 8y agoIf you want to test this in Firefox you can set these prefs: security.insecure_connection_icon.enabled security.insecure_connection_text.enabled
- zelon88 8y agoI think it's funny that Google wants to start marking HTTPS as insecure and yet Google Search Console's "Fetch as Google" won't even follow a 301 response that redirects HTTP queries to HTTPS.
- jbb67 8y agoBye bye chrome. You were useful until you started pushing your agenda on everyone
- sarif 8y agoYou're kidding right? Its 2018, there is no reason to not use https these days. With lets encrypt its not like its costing you anything.
- icedchai 8y agoTime is money. It takes time to set it up.
- synotna 8y agoSo does showering, and you do that before interacting with people outside right?
- sarif 8y agodamn, I should do what you do for a living if five whole minutes costs that much.
- icedchai 8y agoIt's easy for people like us to set it up. I've set up Letsencrypt many, many times. Now, imagine you are Joe Blow hosting his blog on some small web host that barely supports Wordpress. Logging into CPanel is confusing to you. How do you deploy SSL?
- sarif 8y agothat is a fair point.
- icedchai 8y agoIt looks like CPanel does support a letsencrypt plugin, which is really cool: https://blog.cpanel.com/announcing-cpanel-whms-official-lets-encrypt-with-autossl-plugin/ https://blog.cpanel.com/announcing-cpanel-whms-official-lets... However, I have to wonder how many hosts actually enable it...
- trevorhinesley 8y agoI thought this had been the case for a while now? I swear I've seen this headline 10 times in the last two years.
- tialaramex 8y agoChrome in particular has been gradually tightening things up. So there have been similar stories, as well as of course both the announcement and then it actually happening both get a HN story. For example, a while back Chrome changed their porn viewing mode ("Incognito") to label HTTP Not Secure, and changed normal mode to mark pages Not Secure if the user seems to be filling out a form.
- throw2016 8y agoTechnical people should not be pushing centralization and vested interests, that's not a technical solution. In the a world of state surveillance and invasive data practices by SV based companies it's a difficult to understand this obsession with http scaremongering by some to perpetuate more centralization.
- romwell 8y ago>it's a difficult to understand this obsession with http scaremongering Your surely meant it's not difficult, right? The first part of your sentence is exactly the answer.
- throw2016 8y agoWhy would that be? Hn is full of people who do not like even essential bureaucracy, let alone an unneeded one. Yet when it comes to superfluous certificate authorities suddenly its ok? That does not make sense. Everyone is concerned about centralization in other contexts but do not see the downsides of certificate centralization and control? How is it that there is no technical solution that does not involve 'authorities'? This is how control works, first its innocuous and harmless - just get a cert, its even free from letsencrypt. Then after that is accepted its x,y,z. Then its x,y,z and your first newborn. And now you have a way to effectively prevent people from publishing and can silence dissent and anything you don't like under the cover of 'process'.
- romwell 8y agoWait, you don't see the obvious benefits of a local coffee shop page displaying its address and hours being served over an encrypted and secured connection? Sarcasm aside, I think that the big organizations pushing for HTTPS everywhere also tend to employ a lot of people who visit HN; company culture does have an effect.
- doctorwho 8y agoChrome is a jerk
- bcheung 8y agoHTTPS is definitely good but this is a bit strong handed. Many small devs don't want to deal with the complexity of HTTPS and the extra fees. It's a lot better with Let's Encrypt but I've talked to non technical people who have shelled out $300/year to their host providers just to have HTTPS and inevitably lots of things break due to hard coded links in their outdated software. If authentication happens through a 3rd party provider and the there isn't any need for a site to be secure, why force the matter? Broken sites lead to a massive drop in sales. All because Google thinks it knows best. If they truly wanted to solve the problem, why don't they offer a proxy, that converts HTTP traffic to HTTPS traffic that gets used in Chrome. Instead they force people who don't have the technical knowledge that they can get HTTPS for free to pay huge fees and inevitably have their sites broken in the process.
- bcheung 8y agoAnd yet they recently changed it so that if you name a text field username or password it will get filled in with the current user's info, even when it is an admin page where you create new users. There is no way to instruct Chrome to NOT autofill your credentials onto another user. They removed support for the HTML attributes ages ago and even removed the workaround (hidden fields with display: none that don't get used) developers used to prevent this behavior.
- ceejayoz 8y agoYup. I had to disable autofill entirely to stop obliterating users' data in an app I work with.
- diegoperini 8y agoNot sure if asked but, how can I enable HTTPS for my statically hosted Github.io site CNAMEd under my own domain?
- jacksmith21006 8y agoGood to see Google doing this. Really no execuse any longer to have not implemenated TLS/SSL.