7 ms·

Chrome 68 Released: HTTP Sites Marked as “Not Secure”

109 points by l2dy 8y ago

pilif 8y ago
As somebody on the dev build train normally I've seen this change for quite a while now and my brain quickly stopped processing the warning on HTTP only sites. I hope that flipping the switch now will cause enough of the remaining non-https sites to start looking into switching before Chrome feels the need to start adding "more prominent" warnings (for example using a modal dialog). I agree that, yes, in general, we should all be using HTTPS on the internet, but non-secured HTTP still makes sense for example during development or for home routers and printers where traffic encryption is less important compared to the initial UX (my parents could probably set up a home router on their own if it's using non-encrypted HTTP but they would be totally unable to proceed if it's using a self-signed cert).
- nodesocket 8y ago
  I think one solution would be to make the secure badge more prominent, thus when insecure your eye would be attracted to it. One solution would to be make the entire background color of the secure badge green and invert "Secure" text white.
  - lozenge 8y ago
    That's basically the approach taken so far and it hasn't worked. Users don't notice these decorations. Chrome wants to move away from the "Secure" wording because people don't understand what it means, for example, they think it means they can trust the site not to misuse their credit card details.
    - danieldk 8y ago
      Well, it doesn't help that the text (when clicking on 'Secure') says: Your information (for example, passwords and credit card numbers) is private when it is sent to this site. To the layman this means: Chrome says it is safe to enter credentials on this site (and not that it just means that it is hard to eavesdrop on the connection), especially that because this does not say anything about the trustworthiness of the site.
      - nsgi 8y ago
        How would you phrase it instead, that would communicate the nuances of the issue and allow the lay user to assess the risk?
  - anabala 8y ago
    People are quickly getting 'warning' fatigue. Endless popups on websites warning them about cookies?! Asking them to accept stupid privacy policies, alerting them to gdpr rules. The internet is fast becoming unusable because of all this utter nonsense.
  - OskarS 8y ago
    I think it should be more prominent than that: make it the size and style of the "do you want to accept notifications?" dialog. It should be unmissable by users that they're on an insecure site.
    - Jaruzel 8y ago
      ... only if it did it for non private IP ranges. Otherwise all your home stuff would constantly be throwing up notifications.
- angrygoat 8y ago
  I don't think it's really about what end-users do with the warning, or whether they tune it out; site owners will not want a big "Not Secure" badge showing next to their page, right next to their domain / brand. This change creates a powerful incentive for sites to move over to HTTPS.
- xg15 8y ago
  > non-secured HTTP still makes sense for example during development or for home routers and printers where traffic encryption is less important compared to the initial UX I think this goes deeper. Currently, supporting HTTPS means you have to have some kind of internet connection, back-end infrastructure and other running costs. Even if you use Let's Encrypt and DNS validation, you will have running costs to keep the domain name registered and you will need some way to periodically transfer new certificates to your devices. Even if you somehow manage to update the device without a permanent internet connection, if someone wants to access the web interface, they will have to use the domain name - and therefore at least need to be connected to an internet DNS server so the domain resolves. So if, at some point, browsers would completely drop support for HTTP, this would suddenly force any kind of device with a web interface into an IoT-style lifecycle where the device loses functionality once its vendor is not able to support it anymore - even if the vendor would want people to continue using the device and even if there is no technical reason for it.
  - tialaramex 8y ago
    Devices don't _have_ to prevent you from choosing their name. If I name the device my-funky-hatstand.tialaramex.example, then even if the Funky Hatstand company goes out of business and their domain name goes away, I can renew my certs, for my name. For a $5 product it may not make sense to have this level of configuration, but for example I believe the FireBrick (a device you might buy to put a small company or district office online) is capable of being configured with your name rather than a generic product DNS name that could go away. Also, just because a name is in DNS doesn't mean you must use the Internet to resolve the name. In a truly offline system you can just hard code that name resolution and it'll work fine. Nothing about HTTPS cares how resolution was actually done, only the BRs for the Certificate Authorities tell them they mustn't issue for names that aren't actually part of the public DNS hierarchy. So, the device needn't be on the Internet. The name must make sense in the Internet DNS hierarchy, but (with a typical commercial CA) needn't actually exist or (with Let's Encrypt, who insist on checking) needn't resolve to anything, let alone an actual machine on the Internet Yes, you will need to move new certs to a device if you want it to remain publicly trusted as time passes. If that's an unacceptable burden (maybe your device is under the North Pole ice) then you probably didn't want the Web PKI, you need your own PKI for your very special application. Most people want the Web PKI.
- MaxBarraclough 8y ago
  Agreed. I'm sure Google will take that into account if they decide to ramp-up the prominence of the 'warning'. As it is, the warning seems to be disabled for localhost/127.0.0.1 (where I only see a 'not secure' if I manually click the ⓘ) but the warning shows as usual if I browse a local IP address over plaintext HTTP.
- vicbun 8y ago
  > non-secured HTTP still makes sense for example during development To make it easier & cleaner in development, it's best to make yourself a Certificate Authority CA and issues local certificates. This makes for no warnings in browsers and ensures a better development experience. A post from my colleague on how to do it https://reactpaths.com/how-to-get-https-working-in-localhost-development-environment-f17de34af046 https://reactpaths.com/how-to-get-https-working-in-localhost...
  - pilif 8y ago
    > To make it easier & cleaner in development, it's best to make yourself a Certificate Authority CA and issues local certificates sure. That's what I do on those sites where I absolutely need SSL even during development. But it's still a hassle and, I would argue, an overall security downgrade. If somehow that CA certificate gets out (commited to github by accident, extracted via malware, etc.), I become MitMable unless I manually check every certificate of every site I visit. I know that this isn't too likely an attack vector, but if I had to target a developer friend, that's something I'd look into because this has the potential to work across machines whereas traditional malware based solutions would only work on machines I can compromise. If you have unique CAs per development machine, this would of course be moot, but at that point, you might as well just run with a self-signed cert to begin with and allow the exception once.
    - tialaramex 8y ago
      Certificates are public documents, it isn't a problem if everybody sees them. Committing the certificate is, at worst, a minor inconvenience for someone who doesn't want your certificate because they don't trust your CA. A _Private Key_ is the thing that needs to be kept private, in Microsoft Windows it's common to bundle this together with a corresponding Certificate in a single file, often with the filename extension .PFX I assume it's more "convenient" this way, shame about the security. If you do this a LOT (maybe you're a team of fifty developers at a software company that mostly builds web apps but has a strict policy of not using "real" certificates or wildcards) you should mimic the hierarchy required of "real" public Certificate Authorities: Mint a "root CA". You'll end up with a certificate and a private key, let's call them root-C and root-P. Every developer (and QA and so on) system needs to trust root-C, you can use Group Policy or similar tools to arrange that. Use the root CA to issue a sub-CA, the "issuing CA". Write _constraints_ in the certificate used to issue this sub-CA. A constraint is a rule about what things the Subject is an authority about in the opinion of the Issuer. So for example if you set a DNS constraint of just example.com, certs for example.org, or google.com from this Issuing CA don't work. If you later acquire example.org, you can "just" replace the Issuing CA. No updates to employee systems. Think about the Constraints you write, so that they block "mistakes" like MITMing google.com, but not anything you expect to actually need. You can also constrain the types of certs issued. Will you only issue TLS server certs? Then write a constraint saying so. Now, lock away root-P, a serious CA has it in a special hardware device to protect it, but a USB key in a locked desk drawer is a good first step. The Issuing CA credentials will probably need to stay live on someone's computer, they're valuable of course, but because of the Constraints they now aren't an unlimited black hole in your security.
- epanchin 8y ago
  Did they remove the “Secure” label too? Doesn’t say in the blog post.
  - Vinnl 8y ago
    No, that will happen later.
jbb67 8y ago
Goodbye chrome then. Basically corporate scumbags pushing their own agenda with just enough plausibility that the gullible will help push their agenda for them. What happened to "do no evil". Seems to be all google do now.
- akmittal 8y ago
  whats the evil here, I guess Mozilla is also planning to do this in future.
  - ealhad 8y ago
    Firefox has been doing that for some time now, but you have to click on the information logo left of the address bar to see the “Connection is not secure” warning.
- dtech 8y ago
  What evil agenda does Google have for pushing HTTPS-by-default?
  - deleted 8y ago
    [deleted]
- ahmedalsudani 8y ago
  You probably have the wrong idea here. https is not a cash grab or an information gathering tool. It’s the opposite--technology that protects users’ privacy.
- matthewmacleod 8y ago
  What on earth are you talking about? I've heard this nonsense over and over again, and not a single person has been able to provide a plausible explanation why this is a bad thing to do.
  - moviuro 8y ago
    See https://scotthelme.co.uk/https-anti-vaxxers/ https://scotthelme.co.uk/https-anti-vaxxers/
mosselman 8y ago
How about blogs that only work with JavaScript and external sources allowed? Those sites should be marked as "Not worth your time"
- ahje 8y ago
  The link works well in links, suggesting your problem description is invalid. Are you allowing execution of some of the JS on the site perhaps?
niel 8y ago
For anyone wondering exactly what the current plan is regarding these secure/not-secure indicators in upcoming releases, the Chromium Project has a detailed proposal and timeline: https://www.chromium.org/Home/chromium-security/marking-http-as-non-secure https://www.chromium.org/Home/chromium-security/marking-http... Basically it comes down to eventually removing "secure" indicators completely and only indicating when a page is considered "not secure". As an aside, Let's Encrypt has been a godsend to me during this change.
- tmikaeld 8y ago
  "Let's Encrypt has been a godsend to me during this change." I think that's what made Google push this, since they are on the board of advisors for the Let's encrypt certificate authority.
  - nsgi 8y ago
    It's more likely that Google's support for HTTPS everywhere caused them to do both. It introduced HTTPS as a ranking signal in 2014, well before Let's Encrypt.
Dolores12 8y ago
All legacy content heritage that is hosted using http protocol just became not secure in Chrome. What solution does google suggest? Who will pay to upgrade old infrastructure? Pandora box.
- ealhad 8y ago
  All legacy content that is hosted using http protocol is, in fact, not secure. It's definitely not a bad thing to warn people.
  - Dolores12 8y ago
    For general public 'not secure' imply something like 'not safe'.
    - beezle 8y ago
      That is exactly why Google's choice of wording is so poor. Far better would be 'encrypted/not encrypted' as that is all https really is. Safe can have far to many meanings and I won't be at all surprised when Google faces a class action when 'unsafe' things happen on a website they deem 'safe.' Personally don't understand the heavy push to force https on everything and anything. The maintenance/time required to set up and maintain is not insignificant and is really quite pointless in many situations. Do you really need an encrypted connection to LOLCats?
      - ealhad 8y ago
        You need an encrypted connection, period. If you only use an encrypted connection when you need it, then one can know that, well, you need it. You have nothing to hide... until you do.
  - mynewaccount0 8y ago
    Somebody better warn the Debian maintainers that their packages have been Not Secure for the past decade-or-more.
- 8y ago
Sol- 8y ago
Surely a good thing since marking HTTPS as "secure" was always a bit misleading and normal users didn't understand that you were still subject to phishing attempts and such even with an encrypted transport and authenticated servers. Now it reflects the real world better: HTTPS is necessary but not sufficient for security, but with HTTP only you definitely don't have much security. I guess that's the best you can guarantee or communicate via the browser UI.
- ealhad 8y ago
  This, exactly.
- dvfjsdhgfv 8y ago
  > marking HTTPS as "secure" was always a bit misleading This doesn't stop companies and many individuals calling HTTPS "secure".
- blntechie 8y ago
  > marking HTTPS as "secure" was always a bit misleading You are right but when the protocol name says 'Secure' right in its name, no wonder people market it as 'Secure'.
  - jazoom 8y ago
    The protocol is secure. The webpage, who knows?
- gaius 8y ago
  Indeed. Let’s Encrypt would happily issue a cert to scams4u.com provided only proof that the person making the request has control over the domain (that really is all they check). “Secure” implies far, far more than merely “encrypted”. The biggest security problems are behind the web server, not between you and it!
  - mort96 8y ago
    I know it probably wasn't your intention to single out Let's Encrypt, but it's probably worth mentioning that almost any registrar, not just LE, would issue a certificate for a scam site, provided they can prove they own the domain.
omeid2 8y ago
To play the devil's advocate and being very cynic (which is always fair game IMHO): This change has the effect of pushing even mundane websites to use SSL, and so locking out corporate-level and other players from analysing web usage, or at least making them less effective, which enhances and increases the Google's "web scale" analysis dominant position even more.
- RandomInteger4 8y ago
  Nani? What does https have to do with analyzing web usage? Whatever that means exactly.
  - ealhad 8y ago
    When using HTTPS, our ISP can only see the server you're connecting to, not what you're doing.
  - omeid2 8y ago
    ISPs (almost all of them) and lots of corporate (school, business, university) firewalls run analysers on websites and aggregate that data. This data can provide a fair bit of powerful insight and intelligence into things like change of trends and growth of businesses.
- exikyut 8y ago
  I have this exact problem on my LAN. https://news.ycombinator.com/item?id=17540111 https://news.ycombinator.com/item?id=17540111 In order to analyze my own information/data, I have to break HTTPS (setup a proxy MITM box, install CAs on all devices), then put it back together again securely enough (secure++ the MITM box) to be confident in doing my banking etc. Argh.
  - nsgi 8y ago
    What stops you either using a browser extension or analysing encrypted data sent between IPs?
- swebs 8y ago
michaelt 8y ago
So has Google said how they expect router configuration pages, network printers, NAS boxes and other local-network-connected devices to deal with this? I mean, I know Plex has an arrangement where they provide a dynamic DNS style record and they have a special deal with Digicert to issue loads of wildcard certificates [1] but that needs a bunch of infrastructure and a special deal with a CA, as well as precluding offline use and breaking if the supplier ever drops support. And obviously, you can also use a self-signed certificate - but that means teaching users "Just click ignore on the invalid certificate warning" and I've heard people say we shouldn't train users to ignore invalid certificate warnings. Is there some alternative solution Google is proposing? [1] https://blog.filippo.io/how-plex-is-doing-https-for-all-its-users/ https://blog.filippo.io/how-plex-is-doing-https-for-all-its-...
- robin_reala 8y ago
  What’s to deal with? It’s still the same as before: not secure.
  - y0ghur7_xxx 8y ago
    > What’s to deal with? It’s still the same as before: not secure. But there is no meaningful way to make it secure. So marking it not secure creates just noise.
    - dullgiulio 8y ago
      Well, also the "delayed" notice at the gate of an airport makes noise. It's informative: you might not be able to do anything about it, but you should know it anyway.
      - y0ghur7_xxx 8y ago
        There is a difference between an information and a warning. If I am entering information on an unencrypted connection on the internet I want a warning. And I don't want to get accustomed to that warning, because if it happens I want to be alerted. If the same thing happens in my local lan I don't want the same warning, because if I get the same warning I will start to ignore it, and not only when I'm in my local lan.
sammorrowdrums 8y ago
Anyone else got stories like this? JustHost, one of the hosts I have a few clients websites on for years, suddenly started to offer free Let's Encrypt SSL certs to protect users from this change (previously you had to pay for fixed IP, and the certificate itself) - what a great thing to happen. All I had to do was change a few .htaccess files, a few DB entries and track down a few template files that had HTTP external JS references. It was enough work that I had to invoice for the conversion (with the option of not bothering) - but annual fees are still the same, clients websites have SSL and every client wanted the upgrade, rather than be marked "insecure". I really think this is a breakthrough change!
- Arkanosis 8y ago
  OVH did the same thing silently in mid-2016 for shared hosting. GitHub Pages did that silently too earlier this year for custom domains, and made an announce in May. That's awesome :)
  - ams6110 8y ago
    My GitHub pages site is serving a certificate that expired in June though, any idea how to get that updated?
    - laurent123456 8y ago
      I had the same problem and it got fixed quickly after I contacted them. It's a bug in their auto-renewal script.
- JeanMarcS 8y ago
  I’ve got a bunch of (very) old websites of clients who never wanted to update them, whatever strategies we tried to make them change. Now they are all asking to migrate, so it’s a good financial opportunity :) (But to be honest, this is money that should have been earned during past years. Some of them are really stubborn)
mstaoru 8y ago
In China, many mainstream websites are still HTTP-only. 99% of government websites are HTTP, including the ones you input very sensitive information into. No wonder black data market for any kind of records including medical, surveillance, tax etc. here is so well developed and cheap. Somehow, SSL certificates for CDNs cost around US$2000/year. Proprietary DNS extensions on Baidu, Alibaba, and Tencent clouds like 30x redirects do not work with HTTPS at all.
- deleted 8y ago
  [deleted]
- PikachuEXE 8y ago
  Which is why we need to enable HTTP for our China users (only) Hates that
  - robin_reala 8y ago
    Does Let’s Ecrypt not work in China? Edit: was doing some reading and found this interesting post: https://vpnpick.com/chinas-wosign-ca-found-threaten-users-lets-encrypt-ca/ https://vpnpick.com/chinas-wosign-ca-found-threaten-users-le...
    - mstaoru 8y ago
      Let's Encrypt works in China, but not the best due to many older Android phones, Windows XP, and general love for IE (I can even see 7-8 sometimes) and QQ browser with also in less recent version does not support SNI.
- exikyut 8y ago
  1. Besides making HTTPS non-mandatory, what else can businesses do to try and attain/maintain a viable presence if they think they have something to offer that may not be antagonistic to the Chinese government? Run on local servers? (By "viable presence", I mean the ability to reach a small level of success and not only be known by those who have figured out how to successfully consistently break through the GFW, or been deemed eligible for a waiver) 2. I'm beginning to see the HTTPS thing as some kind of strategic war move on the part of the US, possibly 5 eyes, possibly other countries. I don't see it making things simpler, only more complicated (one example I can give is https://news.ycombinator.com/item?id=17540111 https://news.ycombinator.com/item?id=17540111 - it's a lot harder for me to analyze Web traffic within my own LAN now, I have to set up a machine capable of breaking HTTPS, then secure it well enough I'm still confident to do my banking/etc).
swebs 8y ago
Anyone have a screenshot of what the new warning looks like?
- moviuro 8y ago
  https://security.googleblog.com/2018/02/a-secure-web-is-here-to-stay.html https://security.googleblog.com/2018/02/a-secure-web-is-here...
jscissr 8y ago
Not related to the 'not secure' marking, but on the page it says they fixed a medium severity security bug reported in 2014. > [$500][394518] Medium CVE-2018-6169: Permissions bypass in extension installation . Reported by Sam P on 2014-07-16 And given the relatively low issue number (e.g. http://crbug.com/394520 http://crbug.com/394520 is from 2014), it's not a typo.
- exikyut 8y ago
  That issue number is "Intermittently, first key stroke is missed". The two issues it links to also deal with keyboard input. I don't see anything security-related in there. O.o
  - jscissr 8y ago
    The actual issue is http://crbug.com/394518 http://crbug.com/394518, which is not public.
manbeena 8y ago
Now it's time to make local development environment also HTTPS. Make yourself a Certificate Authority CA and issues local certificates. This makes for no warnings in browsers and ensures a better development experience. A post from my colleague on how to do it. https://reactpaths.com/how-to-get-https-working-in-localhost-development-environment-f17de34af046 https://reactpaths.com/how-to-get-https-working-in-localhost...
alanfranzoni 8y ago
For all those that scream about local devices and HTTPS: if you really want HTTPS (and your printer/router supports HTTPS) you can get a certificate very easily from let's encrypt: - create an "internal" domain for your lan, e.g. home.example.com - make AWS Route53 handle that zone - create some AWS IAM credentials for Route53 - create some hosts (e.g. router.home.example.com) - use certbot with the route53 dns option to get a certificate and private key. Certbot will automagically add some TXT records to verify hostname ownership and provide you with that. NO NEED to expose anything on your public IPs, but mind you: your hostname will appear in public CT logs. No "greatnascontainingmypartnersnudephotos.home.example.com" hostnames!
- swiley 8y ago
  This requires the device to be connected to the internet often which isn’t always the case. If the device is the gateway you now have a circular dependency (one that will only cause problems rarely but it’s still there.) As long as http still works it’s fine, I think a security warning about it is probably a good thing, but there definitely are places where “just use let’s encrypt” isn’t an acceptable solution.
megaman22 8y ago
Bit silly for a blanket policy. Who cares if a read-only site is delivered over HTTP, HTTPS, or carrier pidgeon?
- freeone3000 8y ago
  If you care at all what the site says, it should be important to you that you can verify who said it.
lylecubed 8y ago
I'm surprised nobody's talking about the political implications here. This could do more damage to the open internet than revoking net neutrality. Here's a link to hn.algolia.com for the search 'ssl revoked.' https://hn.algolia.com/?utm_source=opensearch&utm_medium=search&utm_campaign=opensearch&query=ssl%20revoked&sort=byPopularity&prefix&page=0&dateRange=all&type=story https://hn.algolia.com/?utm_source=opensearch&utm_medium=sea...
yyyyyyggg 8y ago
Nice
yyyyyyggg 8y ago
Y
yyyyyyggg 8y ago
<i>nice</i>

109 points by l2dy 8y ago

As somebody on the dev build train normally I've seen this change for quite a while now and my brain quickly stopped processing the warning on HTTP only sites. I hope that flipping the switch now will cause enough of the remaining non-https sites to start looking into switching before Chrome feels the need to start adding "more prominent" warnings (for example using a modal dialog). I agree that, yes, in general, we should all be using HTTPS on the internet, but non-secured HTTP still makes sense for example during development or for home routers and printers where traffic encryption is less important compared to the initial UX (my parents could probably set up a home router on their own if it's using non-encrypted HTTP but they would be totally unable to proceed if it's using a self-signed cert).

nodesocket 8y ago
I think one solution would be to make the secure badge more prominent, thus when insecure your eye would be attracted to it. One solution would to be make the entire background color of the secure badge green and invert "Secure" text white.
- lozenge 8y ago
  That's basically the approach taken so far and it hasn't worked. Users don't notice these decorations. Chrome wants to move away from the "Secure" wording because people don't understand what it means, for example, they think it means they can trust the site not to misuse their credit card details.
  - danieldk 8y ago
    Well, it doesn't help that the text (when clicking on 'Secure') says: Your information (for example, passwords and credit card numbers) is private when it is sent to this site. To the layman this means: Chrome says it is safe to enter credentials on this site (and not that it just means that it is hard to eavesdrop on the connection), especially that because this does not say anything about the trustworthiness of the site.
    - nsgi 8y ago
      How would you phrase it instead, that would communicate the nuances of the issue and allow the lay user to assess the risk?
- anabala 8y ago
  People are quickly getting 'warning' fatigue. Endless popups on websites warning them about cookies?! Asking them to accept stupid privacy policies, alerting them to gdpr rules. The internet is fast becoming unusable because of all this utter nonsense.
- OskarS 8y ago
  I think it should be more prominent than that: make it the size and style of the "do you want to accept notifications?" dialog. It should be unmissable by users that they're on an insecure site.
  - Jaruzel 8y ago
    ... only if it did it for non private IP ranges. Otherwise all your home stuff would constantly be throwing up notifications.
angrygoat 8y ago
I don't think it's really about what end-users do with the warning, or whether they tune it out; site owners will not want a big "Not Secure" badge showing next to their page, right next to their domain / brand. This change creates a powerful incentive for sites to move over to HTTPS.
xg15 8y ago
> non-secured HTTP still makes sense for example during development or for home routers and printers where traffic encryption is less important compared to the initial UX I think this goes deeper. Currently, supporting HTTPS means you have to have some kind of internet connection, back-end infrastructure and other running costs. Even if you use Let's Encrypt and DNS validation, you will have running costs to keep the domain name registered and you will need some way to periodically transfer new certificates to your devices. Even if you somehow manage to update the device without a permanent internet connection, if someone wants to access the web interface, they will have to use the domain name - and therefore at least need to be connected to an internet DNS server so the domain resolves. So if, at some point, browsers would completely drop support for HTTP, this would suddenly force any kind of device with a web interface into an IoT-style lifecycle where the device loses functionality once its vendor is not able to support it anymore - even if the vendor would want people to continue using the device and even if there is no technical reason for it.
- tialaramex 8y ago
  Devices don't _have_ to prevent you from choosing their name. If I name the device my-funky-hatstand.tialaramex.example, then even if the Funky Hatstand company goes out of business and their domain name goes away, I can renew my certs, for my name. For a $5 product it may not make sense to have this level of configuration, but for example I believe the FireBrick (a device you might buy to put a small company or district office online) is capable of being configured with your name rather than a generic product DNS name that could go away. Also, just because a name is in DNS doesn't mean you must use the Internet to resolve the name. In a truly offline system you can just hard code that name resolution and it'll work fine. Nothing about HTTPS cares how resolution was actually done, only the BRs for the Certificate Authorities tell them they mustn't issue for names that aren't actually part of the public DNS hierarchy. So, the device needn't be on the Internet. The name must make sense in the Internet DNS hierarchy, but (with a typical commercial CA) needn't actually exist or (with Let's Encrypt, who insist on checking) needn't resolve to anything, let alone an actual machine on the Internet Yes, you will need to move new certs to a device if you want it to remain publicly trusted as time passes. If that's an unacceptable burden (maybe your device is under the North Pole ice) then you probably didn't want the Web PKI, you need your own PKI for your very special application. Most people want the Web PKI.
MaxBarraclough 8y ago
Agreed. I'm sure Google will take that into account if they decide to ramp-up the prominence of the 'warning'. As it is, the warning seems to be disabled for localhost/127.0.0.1 (where I only see a 'not secure' if I manually click the ⓘ) but the warning shows as usual if I browse a local IP address over plaintext HTTP.
vicbun 8y ago
> non-secured HTTP still makes sense for example during development To make it easier & cleaner in development, it's best to make yourself a Certificate Authority CA and issues local certificates. This makes for no warnings in browsers and ensures a better development experience. A post from my colleague on how to do it https://reactpaths.com/how-to-get-https-working-in-localhost-development-environment-f17de34af046 https://reactpaths.com/how-to-get-https-working-in-localhost...
- pilif 8y ago
  > To make it easier & cleaner in development, it's best to make yourself a Certificate Authority CA and issues local certificates sure. That's what I do on those sites where I absolutely need SSL even during development. But it's still a hassle and, I would argue, an overall security downgrade. If somehow that CA certificate gets out (commited to github by accident, extracted via malware, etc.), I become MitMable unless I manually check every certificate of every site I visit. I know that this isn't too likely an attack vector, but if I had to target a developer friend, that's something I'd look into because this has the potential to work across machines whereas traditional malware based solutions would only work on machines I can compromise. If you have unique CAs per development machine, this would of course be moot, but at that point, you might as well just run with a self-signed cert to begin with and allow the exception once.
  - tialaramex 8y ago
    Certificates are public documents, it isn't a problem if everybody sees them. Committing the certificate is, at worst, a minor inconvenience for someone who doesn't want your certificate because they don't trust your CA. A _Private Key_ is the thing that needs to be kept private, in Microsoft Windows it's common to bundle this together with a corresponding Certificate in a single file, often with the filename extension .PFX I assume it's more "convenient" this way, shame about the security. If you do this a LOT (maybe you're a team of fifty developers at a software company that mostly builds web apps but has a strict policy of not using "real" certificates or wildcards) you should mimic the hierarchy required of "real" public Certificate Authorities: Mint a "root CA". You'll end up with a certificate and a private key, let's call them root-C and root-P. Every developer (and QA and so on) system needs to trust root-C, you can use Group Policy or similar tools to arrange that. Use the root CA to issue a sub-CA, the "issuing CA". Write _constraints_ in the certificate used to issue this sub-CA. A constraint is a rule about what things the Subject is an authority about in the opinion of the Issuer. So for example if you set a DNS constraint of just example.com, certs for example.org, or google.com from this Issuing CA don't work. If you later acquire example.org, you can "just" replace the Issuing CA. No updates to employee systems. Think about the Constraints you write, so that they block "mistakes" like MITMing google.com, but not anything you expect to actually need. You can also constrain the types of certs issued. Will you only issue TLS server certs? Then write a constraint saying so. Now, lock away root-P, a serious CA has it in a special hardware device to protect it, but a USB key in a locked desk drawer is a good first step. The Issuing CA credentials will probably need to stay live on someone's computer, they're valuable of course, but because of the Constraints they now aren't an unlimited black hole in your security.
epanchin 8y ago
Did they remove the “Secure” label too? Doesn’t say in the blog post.
- Vinnl 8y ago
  No, that will happen later.

jbb67 8y ago

Goodbye chrome then. Basically corporate scumbags pushing their own agenda with just enough plausibility that the gullible will help push their agenda for them. What happened to "do no evil". Seems to be all google do now.

akmittal 8y ago
whats the evil here, I guess Mozilla is also planning to do this in future.
- ealhad 8y ago
  Firefox has been doing that for some time now, but you have to click on the information logo left of the address bar to see the “Connection is not secure” warning.
dtech 8y ago
What evil agenda does Google have for pushing HTTPS-by-default?
- deleted 8y ago
  [deleted]
ahmedalsudani 8y ago
You probably have the wrong idea here. https is not a cash grab or an information gathering tool. It’s the opposite--technology that protects users’ privacy.
matthewmacleod 8y ago
What on earth are you talking about? I've heard this nonsense over and over again, and not a single person has been able to provide a plausible explanation why this is a bad thing to do.
- moviuro 8y ago
  See https://scotthelme.co.uk/https-anti-vaxxers/ https://scotthelme.co.uk/https-anti-vaxxers/

mosselman 8y ago

How about blogs that only work with JavaScript and external sources allowed? Those sites should be marked as "Not worth your time"

ahje 8y ago
The link works well in links, suggesting your problem description is invalid. Are you allowing execution of some of the JS on the site perhaps?

niel 8y ago

For anyone wondering exactly what the current plan is regarding these secure/not-secure indicators in upcoming releases, the Chromium Project has a detailed proposal and timeline: https://www.chromium.org/Home/chromium-security/marking-http-as-non-secure https://www.chromium.org/Home/chromium-security/marking-http... Basically it comes down to eventually removing "secure" indicators completely and only indicating when a page is considered "not secure". As an aside, Let's Encrypt has been a godsend to me during this change.

tmikaeld 8y ago
"Let's Encrypt has been a godsend to me during this change." I think that's what made Google push this, since they are on the board of advisors for the Let's encrypt certificate authority.
- nsgi 8y ago
  It's more likely that Google's support for HTTPS everywhere caused them to do both. It introduced HTTPS as a ranking signal in 2014, well before Let's Encrypt.

Dolores12 8y ago

All legacy content heritage that is hosted using http protocol just became not secure in Chrome. What solution does google suggest? Who will pay to upgrade old infrastructure? Pandora box.

ealhad 8y ago
All legacy content that is hosted using http protocol is, in fact, not secure. It's definitely not a bad thing to warn people.
- Dolores12 8y ago
  For general public 'not secure' imply something like 'not safe'.
  - beezle 8y ago
    That is exactly why Google's choice of wording is so poor. Far better would be 'encrypted/not encrypted' as that is all https really is. Safe can have far to many meanings and I won't be at all surprised when Google faces a class action when 'unsafe' things happen on a website they deem 'safe.' Personally don't understand the heavy push to force https on everything and anything. The maintenance/time required to set up and maintain is not insignificant and is really quite pointless in many situations. Do you really need an encrypted connection to LOLCats?
    - ealhad 8y ago
      You need an encrypted connection, period. If you only use an encrypted connection when you need it, then one can know that, well, you need it. You have nothing to hide... until you do.
- mynewaccount0 8y ago
  Somebody better warn the Debian maintainers that their packages have been Not Secure for the past decade-or-more.
8y ago

Sol- 8y ago

Surely a good thing since marking HTTPS as "secure" was always a bit misleading and normal users didn't understand that you were still subject to phishing attempts and such even with an encrypted transport and authenticated servers. Now it reflects the real world better: HTTPS is necessary but not sufficient for security, but with HTTP only you definitely don't have much security. I guess that's the best you can guarantee or communicate via the browser UI.

ealhad 8y ago
This, exactly.
dvfjsdhgfv 8y ago
> marking HTTPS as "secure" was always a bit misleading This doesn't stop companies and many individuals calling HTTPS "secure".
blntechie 8y ago
> marking HTTPS as "secure" was always a bit misleading You are right but when the protocol name says 'Secure' right in its name, no wonder people market it as 'Secure'.
- jazoom 8y ago
  The protocol is secure. The webpage, who knows?
gaius 8y ago
Indeed. Let’s Encrypt would happily issue a cert to scams4u.com provided only proof that the person making the request has control over the domain (that really is all they check). “Secure” implies far, far more than merely “encrypted”. The biggest security problems are behind the web server, not between you and it!
- mort96 8y ago
  I know it probably wasn't your intention to single out Let's Encrypt, but it's probably worth mentioning that almost any registrar, not just LE, would issue a certificate for a scam site, provided they can prove they own the domain.

omeid2 8y ago

To play the devil's advocate and being very cynic (which is always fair game IMHO): This change has the effect of pushing even mundane websites to use SSL, and so locking out corporate-level and other players from analysing web usage, or at least making them less effective, which enhances and increases the Google's "web scale" analysis dominant position even more.

RandomInteger4 8y ago
Nani? What does https have to do with analyzing web usage? Whatever that means exactly.
- ealhad 8y ago
  When using HTTPS, our ISP can only see the server you're connecting to, not what you're doing.
- omeid2 8y ago
  ISPs (almost all of them) and lots of corporate (school, business, university) firewalls run analysers on websites and aggregate that data. This data can provide a fair bit of powerful insight and intelligence into things like change of trends and growth of businesses.
exikyut 8y ago
I have this exact problem on my LAN. https://news.ycombinator.com/item?id=17540111 https://news.ycombinator.com/item?id=17540111 In order to analyze my own information/data, I have to break HTTPS (setup a proxy MITM box, install CAs on all devices), then put it back together again securely enough (secure++ the MITM box) to be confident in doing my banking etc. Argh.
- nsgi 8y ago
  What stops you either using a browser extension or analysing encrypted data sent between IPs?
swebs 8y ago

michaelt 8y ago

So has Google said how they expect router configuration pages, network printers, NAS boxes and other local-network-connected devices to deal with this? I mean, I know Plex has an arrangement where they provide a dynamic DNS style record and they have a special deal with Digicert to issue loads of wildcard certificates [1] but that needs a bunch of infrastructure and a special deal with a CA, as well as precluding offline use and breaking if the supplier ever drops support. And obviously, you can also use a self-signed certificate - but that means teaching users "Just click ignore on the invalid certificate warning" and I've heard people say we shouldn't train users to ignore invalid certificate warnings. Is there some alternative solution Google is proposing? [1] https://blog.filippo.io/how-plex-is-doing-https-for-all-its-users/ https://blog.filippo.io/how-plex-is-doing-https-for-all-its-...

robin_reala 8y ago
What’s to deal with? It’s still the same as before: not secure.
- y0ghur7_xxx 8y ago
  > What’s to deal with? It’s still the same as before: not secure. But there is no meaningful way to make it secure. So marking it not secure creates just noise.
  - dullgiulio 8y ago
    Well, also the "delayed" notice at the gate of an airport makes noise. It's informative: you might not be able to do anything about it, but you should know it anyway.
    - y0ghur7_xxx 8y ago
      There is a difference between an information and a warning. If I am entering information on an unencrypted connection on the internet I want a warning. And I don't want to get accustomed to that warning, because if it happens I want to be alerted. If the same thing happens in my local lan I don't want the same warning, because if I get the same warning I will start to ignore it, and not only when I'm in my local lan.

sammorrowdrums 8y ago

Anyone else got stories like this? JustHost, one of the hosts I have a few clients websites on for years, suddenly started to offer free Let's Encrypt SSL certs to protect users from this change (previously you had to pay for fixed IP, and the certificate itself) - what a great thing to happen. All I had to do was change a few .htaccess files, a few DB entries and track down a few template files that had HTTP external JS references. It was enough work that I had to invoice for the conversion (with the option of not bothering) - but annual fees are still the same, clients websites have SSL and every client wanted the upgrade, rather than be marked "insecure". I really think this is a breakthrough change!

Arkanosis 8y ago
OVH did the same thing silently in mid-2016 for shared hosting. GitHub Pages did that silently too earlier this year for custom domains, and made an announce in May. That's awesome :)
- ams6110 8y ago
  My GitHub pages site is serving a certificate that expired in June though, any idea how to get that updated?
  - laurent123456 8y ago
    I had the same problem and it got fixed quickly after I contacted them. It's a bug in their auto-renewal script.
JeanMarcS 8y ago
I’ve got a bunch of (very) old websites of clients who never wanted to update them, whatever strategies we tried to make them change. Now they are all asking to migrate, so it’s a good financial opportunity :) (But to be honest, this is money that should have been earned during past years. Some of them are really stubborn)

mstaoru 8y ago

In China, many mainstream websites are still HTTP-only. 99% of government websites are HTTP, including the ones you input very sensitive information into. No wonder black data market for any kind of records including medical, surveillance, tax etc. here is so well developed and cheap. Somehow, SSL certificates for CDNs cost around US$2000/year. Proprietary DNS extensions on Baidu, Alibaba, and Tencent clouds like 30x redirects do not work with HTTPS at all.

deleted 8y ago
[deleted]
PikachuEXE 8y ago
Which is why we need to enable HTTP for our China users (only) Hates that
- robin_reala 8y ago
  Does Let’s Ecrypt not work in China? Edit: was doing some reading and found this interesting post: https://vpnpick.com/chinas-wosign-ca-found-threaten-users-lets-encrypt-ca/ https://vpnpick.com/chinas-wosign-ca-found-threaten-users-le...
  - mstaoru 8y ago
    Let's Encrypt works in China, but not the best due to many older Android phones, Windows XP, and general love for IE (I can even see 7-8 sometimes) and QQ browser with also in less recent version does not support SNI.
exikyut 8y ago
1. Besides making HTTPS non-mandatory, what else can businesses do to try and attain/maintain a viable presence if they think they have something to offer that may not be antagonistic to the Chinese government? Run on local servers? (By "viable presence", I mean the ability to reach a small level of success and not only be known by those who have figured out how to successfully consistently break through the GFW, or been deemed eligible for a waiver) 2. I'm beginning to see the HTTPS thing as some kind of strategic war move on the part of the US, possibly 5 eyes, possibly other countries. I don't see it making things simpler, only more complicated (one example I can give is https://news.ycombinator.com/item?id=17540111 https://news.ycombinator.com/item?id=17540111 - it's a lot harder for me to analyze Web traffic within my own LAN now, I have to set up a machine capable of breaking HTTPS, then secure it well enough I'm still confident to do my banking/etc).

swebs 8y ago

Anyone have a screenshot of what the new warning looks like?

moviuro 8y ago
https://security.googleblog.com/2018/02/a-secure-web-is-here-to-stay.html https://security.googleblog.com/2018/02/a-secure-web-is-here...

jscissr 8y ago

Not related to the 'not secure' marking, but on the page it says they fixed a medium severity security bug reported in 2014. > [$500][394518] Medium CVE-2018-6169: Permissions bypass in extension installation . Reported by Sam P on 2014-07-16 And given the relatively low issue number (e.g. http://crbug.com/394520 http://crbug.com/394520 is from 2014), it's not a typo.

exikyut 8y ago
That issue number is "Intermittently, first key stroke is missed". The two issues it links to also deal with keyboard input. I don't see anything security-related in there. O.o
- jscissr 8y ago
  The actual issue is http://crbug.com/394518 http://crbug.com/394518, which is not public.

manbeena 8y ago

Now it's time to make local development environment also HTTPS. Make yourself a Certificate Authority CA and issues local certificates. This makes for no warnings in browsers and ensures a better development experience. A post from my colleague on how to do it. https://reactpaths.com/how-to-get-https-working-in-localhost-development-environment-f17de34af046 https://reactpaths.com/how-to-get-https-working-in-localhost...

alanfranzoni 8y ago

For all those that scream about local devices and HTTPS: if you really want HTTPS (and your printer/router supports HTTPS) you can get a certificate very easily from let's encrypt: - create an "internal" domain for your lan, e.g. home.example.com - make AWS Route53 handle that zone - create some AWS IAM credentials for Route53 - create some hosts (e.g. router.home.example.com) - use certbot with the route53 dns option to get a certificate and private key. Certbot will automagically add some TXT records to verify hostname ownership and provide you with that. NO NEED to expose anything on your public IPs, but mind you: your hostname will appear in public CT logs. No "greatnascontainingmypartnersnudephotos.home.example.com" hostnames!

swiley 8y ago
This requires the device to be connected to the internet often which isn’t always the case. If the device is the gateway you now have a circular dependency (one that will only cause problems rarely but it’s still there.) As long as http still works it’s fine, I think a security warning about it is probably a good thing, but there definitely are places where “just use let’s encrypt” isn’t an acceptable solution.

megaman22 8y ago

Bit silly for a blanket policy. Who cares if a read-only site is delivered over HTTP, HTTPS, or carrier pidgeon?

freeone3000 8y ago
If you care at all what the site says, it should be important to you that you can verify who said it.

lylecubed 8y ago

I'm surprised nobody's talking about the political implications here. This could do more damage to the open internet than revoking net neutrality. Here's a link to hn.algolia.com for the search 'ssl revoked.' https://hn.algolia.com/?utm_source=opensearch&utm_medium=search&utm_campaign=opensearch&query=ssl%20revoked&sort=byPopularity&prefix&page=0&dateRange=all&type=story https://hn.algolia.com/?utm_source=opensearch&utm_medium=sea...

yyyyyyggg 8y ago

Nice

yyyyyyggg 8y ago