4 ms·

For devices not connected to internet, the choices are: - HTTP access, insecure and some browser functionality is unavailable for pages/SPA's served over HTTP.

For devices not connected to internet, the choices are: - HTTP access, insecure and some browser functionality is unavailable for pages/SPA's served over HTTP. - HTTPS and tell the user (maybe in a previous HTTP page before a redirect) to dismiss the browser big warning. - Custom iOS/Android/Desktop app to access it, using an encrypted protocol There is a (defunct?) W3C group working on this problem: - https://www.w3.org/community/httpslocal/ https://www.w3.org/community/httpslocal/ - https://github.com/httpslocal https://github.com/httpslocal

ta76893547 6y ago
> - HTTP access, insecure and some browser functionality is unavailable for pages/SPA's served over HTTP. > - HTTPS and tell the user (maybe in a previous HTTP page before a redirect) to dismiss the browser big warning. That's not really true though, right? I think the options are actually: - HTTP access, insecure and some browser functionality is unavailable for pages/SPA's served over HTTP. - HTTPS, insecure and tell the user (maybe in a previous HTTP page before a redirect) to dismiss the browser big warning, but some more web APIs work. Unless I'm mistaken with a self-signed cert you gain none of the actual security guarantees of https with a CA mostly stemming from the fact that there is no authenticity and MITM is trivial. I think it's a bad idea to pretend to a user that a connection is secure if it actually isn't. The solution I think would be to open up web apis to local http connections and create a verification system for self-signed devices like signal, matrix, and probably other systems have.
- nahuel0x 6y ago
  You are right, maybe the browser UX should have been to mark sites as: - "Not secure" for HTTP - "Low security" for HTTPS encrypted but not authenticated (MITM still possible) - "High security" for HTTPS encrypted and authenticated
zbrozek 6y ago
My completely-uninformed bet is that the ability to access sites with self-signed or expired certificates will get hidden behind a flag and ultimately removed from Chrome. Probably in 2-3 years?
- bserge 6y ago
  That's when I start using old versions, security/features be damned. Just like Firefox for Android.
- throw0101a 6y ago
  Then the IT people will install some other browsers. Because there's a lot of embedded stuff out there (HVAC, UPSes, etc) that will never have "real" certificates, and those need to be accessible. So if Chrome wants to piss off the Alpha Geeks in an organization, the folks who decide what software is used, not allowing any kind of override is a good way to do it.
- ClumsyPilot 6y ago
  So how are you meant to access devices on LAN securely?
  - ThePadawan 6y ago
    Instead of self-signing certs, create your own LAN-local CA and create locally valid certificates via that CA.
    - ClumsyPilot 6y ago
      And then install that cert on every device that enters my home? Thats not practical.
  - zbrozek 6y ago
    You mean your Google router? There will be an Android app or some new device setup pseudo-standard that Chrome will support.
Wowfunhappy 6y ago
Out of those options, using HTTP seems like the obvious choice.
- IshKebab 6y ago
  Browsers will soon (or maybe already have?) treat HTTP the same as self-signed HTTPS, so HTTPS is probably the better solution.
  - Wowfunhappy 6y ago
    I would argue this is a strong argument against browsers treating http traffic that way. There needs to be a solution for this use case. Training people to ignore warning messages is clearly worse than just using http and letting the browser respond by disabling some features for safety.
swiley 6y ago
Or just have them use ssh. Every popular OS besides android (that's OSX, windows, GNU/Linux, iOS, all the BSDs) ship with an ssh client (almost always openssh.) It would be nice if they all came with a VTE that worked over bluetooth. Windows used to come with it's own VTE for dialing modems so obviously users can handle it.

ta76893547 6y ago

> - HTTP access, insecure and some browser functionality is unavailable for pages/SPA's served over HTTP. > - HTTPS and tell the user (maybe in a previous HTTP page before a redirect) to dismiss the browser big warning. That's not really true though, right? I think the options are actually: - HTTP access, insecure and some browser functionality is unavailable for pages/SPA's served over HTTP. - HTTPS, insecure and tell the user (maybe in a previous HTTP page before a redirect) to dismiss the browser big warning, but some more web APIs work. Unless I'm mistaken with a self-signed cert you gain none of the actual security guarantees of https with a CA mostly stemming from the fact that there is no authenticity and MITM is trivial. I think it's a bad idea to pretend to a user that a connection is secure if it actually isn't. The solution I think would be to open up web apis to local http connections and create a verification system for self-signed devices like signal, matrix, and probably other systems have.

nahuel0x 6y ago
You are right, maybe the browser UX should have been to mark sites as: - "Not secure" for HTTP - "Low security" for HTTPS encrypted but not authenticated (MITM still possible) - "High security" for HTTPS encrypted and authenticated

zbrozek 6y ago

My completely-uninformed bet is that the ability to access sites with self-signed or expired certificates will get hidden behind a flag and ultimately removed from Chrome. Probably in 2-3 years?

bserge 6y ago
That's when I start using old versions, security/features be damned. Just like Firefox for Android.
throw0101a 6y ago
Then the IT people will install some other browsers. Because there's a lot of embedded stuff out there (HVAC, UPSes, etc) that will never have "real" certificates, and those need to be accessible. So if Chrome wants to piss off the Alpha Geeks in an organization, the folks who decide what software is used, not allowing any kind of override is a good way to do it.
ClumsyPilot 6y ago
So how are you meant to access devices on LAN securely?
- ThePadawan 6y ago
  Instead of self-signing certs, create your own LAN-local CA and create locally valid certificates via that CA.
  - ClumsyPilot 6y ago
    And then install that cert on every device that enters my home? Thats not practical.
- zbrozek 6y ago
  You mean your Google router? There will be an Android app or some new device setup pseudo-standard that Chrome will support.

Wowfunhappy 6y ago

Out of those options, using HTTP seems like the obvious choice.

IshKebab 6y ago
Browsers will soon (or maybe already have?) treat HTTP the same as self-signed HTTPS, so HTTPS is probably the better solution.
- Wowfunhappy 6y ago
  I would argue this is a strong argument against browsers treating http traffic that way. There needs to be a solution for this use case. Training people to ignore warning messages is clearly worse than just using http and letting the browser respond by disabling some features for safety.

swiley 6y ago

Or just have them use ssh. Every popular OS besides android (that's OSX, windows, GNU/Linux, iOS, all the BSDs) ship with an ssh client (almost always openssh.) It would be nice if they all came with a VTE that worked over bluetooth. Windows used to come with it's own VTE for dialing modems so obviously users can handle it.