4 ms·
"For sites that don’t yet support HTTPS, Chrome will fall back to HTTP when the HTTPS attempt fails." MITM is still an issue. At some point I hope browsers ca
by jefftk 6y ago
"For sites that don’t yet support HTTPS, Chrome will fall back to HTTP when the HTTPS attempt fails."
MITM is still an issue. At some point I hope browsers can switch to "you have to type http:// http:// if you want HTTP", and this is a step in that direction.
(Disclosure: I work for Google, speaking only for myself)
- ibejoeb 6y agoIt might still be an issue, but this is still a huge improvement. If the browser is going to pick a protocol on behalf of the user, it ought choose a stronger protocol first.
- ipsocannibal 6y agoIf the browser chooses the stronger protocol it should force the user to opt-in to any fallback behavior which might downgrade security. The current behavior of the browser in most cases is if you enter an 'https' url and the request fails or the cert is invalid you get a failure or warning message. I'd like to see this behavior kept in this case. It communicates what the browser is doing instead of silently downgrading the protocol based upon fuzzy failure signals.
- ibejoeb 6y agoThat would be ideal
- banana_giraffe 6y agoI'm curious if that includes falling back to HTTP when HTTPS has worked in the past. I only ask because I'm curious what this will do with captive portal nonsense.
- TimBurr 6y agoI've found http://neverssl.com http://neverssl.com very helpful for captive portals. It does what you'd expect - hosts a HTTP-only page that allows captive portals to work correctly. Since it's only ever HTTP, it sidesteps the certificate errors or HTTP downgrades that normal sites are hit with during captive portal interception. I am curious what happens to captive portals as HTTPS adoption rises. Some OS's (Android, OSX) already detect captive portals and launch a lightweight webview.
- xeromal 6y agoThanks for this. I never can remember URLs like this but I always remember chicken.com. It's sad day to see it go away.
- rnotaro 6y agoI'm French-Canadian I use http://perdu.com http://perdu.com [1] (Perdu is lost in French). It's a light funny page i've found about 10+ years ago but it's HTTP and helpfull for captive portals. [1] https://fr.wikipedia.org/wiki/Perdu.com https://fr.wikipedia.org/wiki/Perdu.com
- banana_giraffe 6y agoYep, I use neverssl.com, when I remember it. Though, mostly I use example.com, since that works without SSL as well. I guess now I'll need to remember to type http://example.com http://example.com . Based off my experience, more and more captive portals appear to be letting the requests the OS makes to captive.apple.com or whatever through but still try to present a captive portal to the user. I can guess as to the motivation, but as a user it's danged annoying.
- marcosdumay 6y agoIt has been a long time since I've seen a captive portal that doesn't trigger the "this connection needs authentication" message on my phone.
- remram 6y agoHSTS takes care of that. It's an HTTP header to indicate not to connect without TLS in the future. It makes sense to keep falling back to HTTP if that header is not set.
- jeswin 6y ago> "you have to type http:// http:// if you want HTTP" That makes sense only to programmers, who make a small fraction of users. Browsers are mainstream; we need to be more thoughtful.
- jefftk 6y agoLong term, to normal users, there should be only HTTPS.
- ipsocannibal 6y agoIts a shame but I wish the insecure protocol name was not a prefix of the secure protocol name. Its so easy to miss the 's' and for things to just work for the wrong reason. I guess we have Netscape and Microsoft to blame for this one. https://en.m.wikipedia.org/wiki/Secure_Hypertext_Transfer_Protocol https://en.m.wikipedia.org/wiki/Secure_Hypertext_Transfer_Pr...
- paganel 6y agoThat is a stupid idea, forcing https on people’s throats is a stupid idea generally speaking but it wouldn’t have been that bad if it hadn’t been forced on many people by what is basically a monopoly by this point.
- greenwich26 6y agoHTTPS is such a scam. It's an obvious ploy to conquer the last corners of the web not yet under corporate control. But apparently calling it "Let's Encrypt" instead of "Let's make your website technically dependent on a Google/Mozilla/Amazon/Facebook-controlled service" is enough to fool people. It's totally obvious to me that, once HTTPS is mandatory, the next step will be that Let's Encrypt will stop supporting websites that disobey their "content policy" or whatever. It will follow the usual course. First outright illegal things. Then today's "deadly sins" like racism. Then unpopular politicians. And then, whatever they want. You are literally making a random organization into the censor of the web.
- shadowgovt 6y agoWhile there are a finite number of trust providers in the HTTPS signed certificate model, "Let's Encrypt" isn't the only one. But, yes, HTTPS is a trust-rooted security model. It's hypothetically possible to have every cert provider decide you're not trusted. That's kind of in the category of "It's hypothetically possible to have every DNS provider decide you're not trusted" though. If this is a concern, the solution is probably to come up with an HTTPS modification that allows for decentralized trust, not to set up the average use case of the web to "The user is trusting every machine between their client and the server to be reading their traffic and not acting maliciously on it." Tradeoffs, right?
- frcom 6y agoAnd you can't just found a new SSL provider. The woke browsers need to accept its certificates. In other words, something like the substack.com escape from the mainstream media won't work.
- shadowgovt 6y ago
- bullen 6y agoHow does HTTPS certificates solve MITM? To me it seems HTTPS _IS_ the MITM... namely the certificate authority!