4 ms·

This is a great step, but I wish browsers would allow you to set domains that are considered to be secure origins in all cases. I have a decent intranet with tr

This is a great step, but I wish browsers would allow you to set domains that are considered to be secure origins in all cases. I have a decent intranet with transport security guaranteed by VPN, but because it isn't "HTTPS" I can't access tons of browser features.

madjam002 6y ago
Isn't this what HSTS does? Maybe a way to manually add domains to the list would be good.
- 1_player 6y ago
  I think GP is asking for a whitelist of HTTP-only domains the browser should consider safe.
Vinnl 6y ago
According to [1] you can disable this for individual sites. [1] https://news.ycombinator.com/item?id=25121929 https://news.ycombinator.com/item?id=25121929
pimterry 6y ago
In Chrome/Chromium-based browsers, you do exactly that here: chrome://flags/#unsafely-treat-insecure-origin-as-secure
zurn 6y ago
HTTPS guarantees a higher level of security than "intranet", it works against on-path adversaries and provides end-to-end confidentiality & integrity & authenticity, plus provides forward security.
- sneak 6y ago
  This is an important point: Modern TLS is often better crypto than most commonly deployed VPNs.
tmsbrg 6y ago
Have a look at Let's Encrypt DNS challenge. I created a DNS wildcard certificate for a subdomain I own and use it for all my internal domains. A great way to get HTTPS on non-public networks. HTTP over VPN is still weaker than HTTPS over VPN. For example HTTPS also handles authentication which HTTP doesn't. If you're outside of your VPN, a MitM could redirect you to http://my-internal-domain.example http://my-internal-domain.example and resolve its DNS to an attacker's website. Your browser would not understand the difference between this and your actual website in your VPN. It would send all the site's cookies to the evil website, and if Service Workers[1] worked over HTTP, this would actually be a way to completely compromise an internal HTTP website. So it's important not to whitelist such HTTP sites as if they're secure. [1] https://developer.mozilla.org/en-US/docs/Web/API/Service_Worker_API https://developer.mozilla.org/en-US/docs/Web/API/Service_Wor...
- iso1631 6y ago
  Deploying to a mix of internal devices, many of which lack the ability to easily allow automatic certificate renewal, is not trivial.
  - kccqzy 6y ago
    Put a reverse proxy in front of it.
    - iso1631 6y ago
      This is generally the best way, as it allows you to use things like client certificates or some other form of authentication to enforce AAA, and reduce the requirement of using VPN (which itself increases the security as it reduces the number of holes in your network) Of course it's still unsecure from your proxy to the device, but that's a more managable risk
- neop1x 6y ago
  Also note that with DNS01 challenge you can add multiple wildcard domains under one certificate. There is a limit of total domains in a certificate but I still find it interesting and helpful.
aljarry 6y ago
I've set up internal CA using minica [0] and trusted that CA in Chrome and Firefox with success. Each host got it's own key, and I'm not even using proper DNS server - I use Avahi, so all of my hosts are available as somehostname.local on all clients with Avahi/Bonjour installed. [0] https://github.com/jsha/minica https://github.com/jsha/minica

madjam002 6y ago

Isn't this what HSTS does? Maybe a way to manually add domains to the list would be good.

1_player 6y ago
I think GP is asking for a whitelist of HTTP-only domains the browser should consider safe.

Vinnl 6y ago

According to [1] you can disable this for individual sites. [1] https://news.ycombinator.com/item?id=25121929 https://news.ycombinator.com/item?id=25121929

pimterry 6y ago

In Chrome/Chromium-based browsers, you do exactly that here: chrome://flags/#unsafely-treat-insecure-origin-as-secure

zurn 6y ago

HTTPS guarantees a higher level of security than "intranet", it works against on-path adversaries and provides end-to-end confidentiality & integrity & authenticity, plus provides forward security.

sneak 6y ago
This is an important point: Modern TLS is often better crypto than most commonly deployed VPNs.

tmsbrg 6y ago

Have a look at Let's Encrypt DNS challenge. I created a DNS wildcard certificate for a subdomain I own and use it for all my internal domains. A great way to get HTTPS on non-public networks. HTTP over VPN is still weaker than HTTPS over VPN. For example HTTPS also handles authentication which HTTP doesn't. If you're outside of your VPN, a MitM could redirect you to http://my-internal-domain.example http://my-internal-domain.example and resolve its DNS to an attacker's website. Your browser would not understand the difference between this and your actual website in your VPN. It would send all the site's cookies to the evil website, and if Service Workers[1] worked over HTTP, this would actually be a way to completely compromise an internal HTTP website. So it's important not to whitelist such HTTP sites as if they're secure. [1] https://developer.mozilla.org/en-US/docs/Web/API/Service_Worker_API https://developer.mozilla.org/en-US/docs/Web/API/Service_Wor...

iso1631 6y ago
Deploying to a mix of internal devices, many of which lack the ability to easily allow automatic certificate renewal, is not trivial.
- kccqzy 6y ago
  Put a reverse proxy in front of it.
  - iso1631 6y ago
    This is generally the best way, as it allows you to use things like client certificates or some other form of authentication to enforce AAA, and reduce the requirement of using VPN (which itself increases the security as it reduces the number of holes in your network) Of course it's still unsecure from your proxy to the device, but that's a more managable risk
neop1x 6y ago
Also note that with DNS01 challenge you can add multiple wildcard domains under one certificate. There is a limit of total domains in a certificate but I still find it interesting and helpful.

aljarry 6y ago

I've set up internal CA using minica [0] and trusted that CA in Chrome and Firefox with success. Each host got it's own key, and I'm not even using proper DNS server - I use Avahi, so all of my hosts are available as somehostname.local on all clients with Avahi/Bonjour installed. [0] https://github.com/jsha/minica https://github.com/jsha/minica