9 ms·

Towards HTTPS by Default

superkuh 3y ago
>For the past several years, more than 90% of Chrome users' navigations have been to HTTPS sites, How do they know this? That's frightening. I guess that's part of why they're so okay with going to HTTPS only; it apparently doesn't stop them from snooping. Adding scaremongering annoyance click-throughts for connections to HTTP is bad too. Much like how the megacorp browsers have made HTTPS self-signed sites unvisitable it looks like they're trying to make HTTP sites unvisitable too. This will not be a problem for for-profit and institutional sites but it'll make most of the old, non-commercial web unvisitable for chrome users. I'm not against HTTPS or HTTPS by default. I think that's a good idea. But stopping people from visiting HTTP sites is something that only makes sense in some contexts. Doing it universally will make the web a much smaller, more profit oriented space (at least for chrome users).
- CharlesW 3y ago
  > How do they know this? I'd assume through ga.js (and urchin.js).
- Lt_Riza_Hawkeye 3y ago
  > How do they know this? I believe the setting "Make searches and browsing better" (subtitle "Send URLs of pages you visit to google") under chrome://settings/syncSetup is on by default if you don't manually uncheck the send usage data checkbox when installing
- kuratkull 3y ago
  Chrome is an extension of Googles ad empire, it spies in you.
- bluefishinit 3y ago
  > How do they know this? That's frightening. It's very frightening, and it's the end result of opt-out telemetry "to make the product better". There are certain pieces of software that should never have telemetry: your OS, your web browser, your terminal, your email client... I choose software written by craftspeople with an opinion who don't "need" telemetry, not software that's just a conduit to hoover up my personal and sensitive data.
  - insanitybit 3y ago
    Is "percentage of sites visited that are HTTP vs HTTPS" "personal" or "sensitive" to you? And if so... how?
    - bluefishinit 3y ago
      Yes, all of my data is sensitive to me. I don't want Google knowing anything about me, including when I use their software.
      - insanitybit 3y ago
        [flagged]
        bluefishinit 3y ago
        Well, I think you're a frog being boiled if you feel that way. My privacy is important to me.
- franky47 3y ago
  Even without snooping on domains (let alone entire URLs), it would be feasible to only observe the protocol part of `window.location` and send it as anonymized telemetry. But who am I kidding, given who we're talking about, I doubt that's what's happening.
- kmeisthax 3y ago
  The snooping is literally just Chrome saying "I've visited 95 pages, 90 of which were encrypted." None of that violates HTTPS's security guarantees; the fact that you are using encryption is not a secret in HTTPS. This isn't scaremongering. Go on any kind of public Wi-Fi and see what horrors the network does to your unencrypted traffic (and how those horrors can get cached and persist when you leave the network). It's actually kind of bonkers that we spent a decade treating unsigned HTTPS as less secure than unencrypted HTTP. As for non-commercial sites, we've had Lets Encrypt for almost a decade at this point. It's literally free, and it's really all you need. There is no excuse for any public facing website with a fully-qualified domain name to not have encryption anymore. As far as I'm aware Chrome isn't trying to ban HTTP connections. All they're doing is giving you a warning. Hell, they're actually making things easier on the old web by doing automatic upgrades. So you don't even need to change your old HTML files, you just need to ensure that you have a cert setup in your server configuration.
  - superkuh 3y ago
    No on is advocating for HTTP only. We're saying webservers should be HTTP+HTTPS.
  - ghusto 3y ago
    > As for non-commercial sites, we've had Lets Encrypt for almost a decade at this point Saying there's "no excuse" to not have HTTPS is presuming there's a benefit in 100% of cases to have it in the first place. I don't want my internal sites breaking because a cert couldn't be updated, on something that didn't need it in the first place. There are even external sites I run that I could argue don't need it.
    - hsbauauvhabzb 3y ago
      Just imagine 10-year-old-us trying to build a website now, and some megacorp slapping us down and saying ‘No TLS no excuse!’
      - unmole 3y ago
- dadrian 3y ago
  It is publicly available data from Chrome's non-URL keyed metrics system. https://transparencyreport.google.com/https/overview?hl=en https://transparencyreport.google.com/https/overview?hl=en
jjkeddo199 3y ago
This globally-enforced move to HTTPS is killing the security and privacy for home projects and intranet-hosted websites. If Google forces HTTPS everywhere, and refuses to accept "self signed HTTPS certs", then there is no path left for security-camera/home-automation/staticIP-family-websites without being forced into going over the internet. I can't even show my projects to my non-technical friends without looking like some scammer because of these dumb warning messages plastered all over their browsers on my own wifi! Chrome team: Either start accepting self-signed certs for LAN, or drop forced HTTPS for intranet altogether -- I DO NOT want to put my family's or my personal-project data on the internet!
- stavros 3y ago
  > I DO NOT want to put my family's or my personal-project data on the internet! Use Firefox?
  - jjkeddo199 3y ago
    Its not as easy as you think to convince your friends/family to install new web browsers. Websites should just work
    - stavros 3y ago
      Websites do just work, the browser doesn't. "You can't access the internal LAN because your browser is bad" should be a compelling reason for them to change.
      - jjcm 3y ago
        A non-technical user doesn’t know that. They just know a site isn’t displaying correctly.
      - NegativeK 3y ago
        "Why do I need to change my internet thing?" "Because Chrome is enforcing security standards that--" "I don't care anymore. I'll keep using the internet I use now."
forgotmypw17 3y ago
HTTP is transparent, human-readable, decentralized, locally hostable without extra work, simpler, lighter, and much more widely compatible. It’s what I’m planning to stick with for the foreseeable future.
Pannoniae 3y ago
What is even worse is that HTTP is getting deprecated. There are entire swathes of web APIs which are only usable over HTTPS, HTTP/2 and HTTP/3 don't even support unencrypted HTTP, and all browsers scream about self-signed HTTPS certificates, treating them worse than unencrypted HTTP. All browser vendors are behind this, even mozilla, this is a global conspiracy to crack down on the open internet.
insanitybit 3y ago
I think people are missing this: > We know that enterprises and education networks have unique needs. These features can be turned on early, customized, or turned off entirely via the HttpsOnlyMode, HttpsUpgradesEnabled, HttpAllowlist, and InsecureContentAllowedForUrls policies. Also a lot of people are talking about internally hosted sites and acting like now you'll have to go pay a CA or something. That is not the case. The worst case scenario is that your internal site will require a click through. If you want to avoid that just issue a certificate yourself for it, either via IP (if Chrome will support that?) or via a domain that you resolve via your router. Or if you control the browser, just... turn this off.
1vuio0pswjnm7 3y ago
"However, a stubborn 5-10% of traffic has remained on HTTP, allowing attackers to eavesdrop on or change that data." How do we stop Google from eavsedropping on us via data exfiltration. Unfortunately, whether intentional or not, HTTPS assists so-called "tech" companies with exfiltration of data from computer users, which they perform on a mass scale. It inhibits computers users from monitoring the traffic, traffic that is initiated by so-called "tech" companies not the users themselves, from their computers to these so-called "tech" companies such as Google. That's a potential problem for computer users but it's an advantage for Google and other so-called "tech" companies that rely on surveillance and data collection in order to profit from online advertising services. Many companies MiTM TLS in order to monitor data exfiltration. Today, many employees work from home. Computer users at home should be allowed to monitor the traffic leaving their home computers and travelling over their home networks. Of the alleged 5-10% of traffic that has remained HTTP it would be useful to know how much is actually being eavesdropped on or changed. How large is this problem in comparison to the problem of data exfiltration. The only example I know of is the case of an ISP injecting online advertising into web pages. When an ISP attempted to inject ads into HTTP, the public responded. The ISP was caught out, immediately. However with data exfiltration protected from public scrutiny via HTTPS, Google can continue to avoid such public objection. Whether it is an ISP injecting ads or Google collecting data to provide services to others who want to inject "personalised" ads, the goal is the same: to profit from annoying users with online ads. Unlike speculative problems of eavesdropping and data manipulation associated with 5-10% of Chrome traffic using HTTP, the amount of useful commercial surveillance data being exiltrated from Chrome is a real and daily occurrence for hundreds of millions of computer users. Chrome's TLS roadblocks and warnings to prevent any and all computer users from acting as their own certificate authorities in order to monitor the traffic from their computers via Chrome are especially dubious. Please do not misinterpret this comment. I am not against TLS or HTTPS. I am in favour of respecting the choice of some users to act as their own CAs in certain situations, for certain purposes. I am against "forced delegation of trust". Everyone has a right to trust themselves as opposed to completely delegating all trust to Google and the commercial CA business. This should be a choice made by the computer user, not Google. Trust is a two-way street. If computer users "trust" Google, then Google must trust computer users.
- 3y ago
joerick 3y ago
While I support the cause, HTTPS is the biggest thing obsoleting old devices in my experience. Currently hitting this with an old eink project that's based on an obsolete ereader. I wonder if there's some kind of proxy I could connect to over HTTP that does the modern HTTPS on my behalf. (I'm aware of the security implications, just want it to get a tweet/weather forecast)
xacky 3y ago
Hopefully Chromium starts wanting ipv6 by default as well and starts putting a warning message on websites still using ipv4 in 2023 too. We are almost at 50% ipv6 usage according to Google, time to start pressuring the laggards.
- p1mrx 3y ago
  Try the IPvFoo extension.
chromoblob 3y ago
> Chrome will automatically upgrade all http:// http:// navigations to https:// https://, even when you click on a link that explicitly declares http:// http://. https: and http: authorities are totally unrelated. Here, https: server will receive and reply to requests that were intended by websites to go to http:, which is dangerous if the two servers aren't controlled by the same author. All in all, an insane change.

>For the past several years, more than 90% of Chrome users' navigations have been to HTTPS sites, How do they know this? That's frightening. I guess that's part of why they're so okay with going to HTTPS only; it apparently doesn't stop them from snooping. Adding scaremongering annoyance click-throughts for connections to HTTP is bad too. Much like how the megacorp browsers have made HTTPS self-signed sites unvisitable it looks like they're trying to make HTTP sites unvisitable too. This will not be a problem for for-profit and institutional sites but it'll make most of the old, non-commercial web unvisitable for chrome users. I'm not against HTTPS or HTTPS by default. I think that's a good idea. But stopping people from visiting HTTP sites is something that only makes sense in some contexts. Doing it universally will make the web a much smaller, more profit oriented space (at least for chrome users).

CharlesW 3y ago
> How do they know this? I'd assume through ga.js (and urchin.js).
Lt_Riza_Hawkeye 3y ago
> How do they know this? I believe the setting "Make searches and browsing better" (subtitle "Send URLs of pages you visit to google") under chrome://settings/syncSetup is on by default if you don't manually uncheck the send usage data checkbox when installing
kuratkull 3y ago
Chrome is an extension of Googles ad empire, it spies in you.
bluefishinit 3y ago
> How do they know this? That's frightening. It's very frightening, and it's the end result of opt-out telemetry "to make the product better". There are certain pieces of software that should never have telemetry: your OS, your web browser, your terminal, your email client... I choose software written by craftspeople with an opinion who don't "need" telemetry, not software that's just a conduit to hoover up my personal and sensitive data.
- insanitybit 3y ago
  Is "percentage of sites visited that are HTTP vs HTTPS" "personal" or "sensitive" to you? And if so... how?
  - bluefishinit 3y ago
    Yes, all of my data is sensitive to me. I don't want Google knowing anything about me, including when I use their software.
    - insanitybit 3y ago
      [flagged]
      - bluefishinit 3y ago
        Well, I think you're a frog being boiled if you feel that way. My privacy is important to me.
franky47 3y ago
Even without snooping on domains (let alone entire URLs), it would be feasible to only observe the protocol part of `window.location` and send it as anonymized telemetry. But who am I kidding, given who we're talking about, I doubt that's what's happening.
kmeisthax 3y ago
The snooping is literally just Chrome saying "I've visited 95 pages, 90 of which were encrypted." None of that violates HTTPS's security guarantees; the fact that you are using encryption is not a secret in HTTPS. This isn't scaremongering. Go on any kind of public Wi-Fi and see what horrors the network does to your unencrypted traffic (and how those horrors can get cached and persist when you leave the network). It's actually kind of bonkers that we spent a decade treating unsigned HTTPS as less secure than unencrypted HTTP. As for non-commercial sites, we've had Lets Encrypt for almost a decade at this point. It's literally free, and it's really all you need. There is no excuse for any public facing website with a fully-qualified domain name to not have encryption anymore. As far as I'm aware Chrome isn't trying to ban HTTP connections. All they're doing is giving you a warning. Hell, they're actually making things easier on the old web by doing automatic upgrades. So you don't even need to change your old HTML files, you just need to ensure that you have a cert setup in your server configuration.
- superkuh 3y ago
  No on is advocating for HTTP only. We're saying webservers should be HTTP+HTTPS.
- ghusto 3y ago
  > As for non-commercial sites, we've had Lets Encrypt for almost a decade at this point Saying there's "no excuse" to not have HTTPS is presuming there's a benefit in 100% of cases to have it in the first place. I don't want my internal sites breaking because a cert couldn't be updated, on something that didn't need it in the first place. There are even external sites I run that I could argue don't need it.
  - hsbauauvhabzb 3y ago
    Just imagine 10-year-old-us trying to build a website now, and some megacorp slapping us down and saying ‘No TLS no excuse!’
    - unmole 3y ago
dadrian 3y ago
It is publicly available data from Chrome's non-URL keyed metrics system. https://transparencyreport.google.com/https/overview?hl=en https://transparencyreport.google.com/https/overview?hl=en

jjkeddo199 3y ago

This globally-enforced move to HTTPS is killing the security and privacy for home projects and intranet-hosted websites. If Google forces HTTPS everywhere, and refuses to accept "self signed HTTPS certs", then there is no path left for security-camera/home-automation/staticIP-family-websites without being forced into going over the internet. I can't even show my projects to my non-technical friends without looking like some scammer because of these dumb warning messages plastered all over their browsers on my own wifi! Chrome team: Either start accepting self-signed certs for LAN, or drop forced HTTPS for intranet altogether -- I DO NOT want to put my family's or my personal-project data on the internet!

stavros 3y ago
> I DO NOT want to put my family's or my personal-project data on the internet! Use Firefox?
- jjkeddo199 3y ago
  Its not as easy as you think to convince your friends/family to install new web browsers. Websites should just work
  - stavros 3y ago
    Websites do just work, the browser doesn't. "You can't access the internal LAN because your browser is bad" should be a compelling reason for them to change.
    - jjcm 3y ago
      A non-technical user doesn’t know that. They just know a site isn’t displaying correctly.
    - NegativeK 3y ago
      "Why do I need to change my internet thing?" "Because Chrome is enforcing security standards that--" "I don't care anymore. I'll keep using the internet I use now."

forgotmypw17 3y ago

HTTP is transparent, human-readable, decentralized, locally hostable without extra work, simpler, lighter, and much more widely compatible. It’s what I’m planning to stick with for the foreseeable future.

Pannoniae 3y ago

What is even worse is that HTTP is getting deprecated. There are entire swathes of web APIs which are only usable over HTTPS, HTTP/2 and HTTP/3 don't even support unencrypted HTTP, and all browsers scream about self-signed HTTPS certificates, treating them worse than unencrypted HTTP. All browser vendors are behind this, even mozilla, this is a global conspiracy to crack down on the open internet.

insanitybit 3y ago

I think people are missing this: > We know that enterprises and education networks have unique needs. These features can be turned on early, customized, or turned off entirely via the HttpsOnlyMode, HttpsUpgradesEnabled, HttpAllowlist, and InsecureContentAllowedForUrls policies. Also a lot of people are talking about internally hosted sites and acting like now you'll have to go pay a CA or something. That is not the case. The worst case scenario is that your internal site will require a click through. If you want to avoid that just issue a certificate yourself for it, either via IP (if Chrome will support that?) or via a domain that you resolve via your router. Or if you control the browser, just... turn this off.

1vuio0pswjnm7 3y ago

"However, a stubborn 5-10% of traffic has remained on HTTP, allowing attackers to eavesdrop on or change that data." How do we stop Google from eavsedropping on us via data exfiltration. Unfortunately, whether intentional or not, HTTPS assists so-called "tech" companies with exfiltration of data from computer users, which they perform on a mass scale. It inhibits computers users from monitoring the traffic, traffic that is initiated by so-called "tech" companies not the users themselves, from their computers to these so-called "tech" companies such as Google. That's a potential problem for computer users but it's an advantage for Google and other so-called "tech" companies that rely on surveillance and data collection in order to profit from online advertising services. Many companies MiTM TLS in order to monitor data exfiltration. Today, many employees work from home. Computer users at home should be allowed to monitor the traffic leaving their home computers and travelling over their home networks. Of the alleged 5-10% of traffic that has remained HTTP it would be useful to know how much is actually being eavesdropped on or changed. How large is this problem in comparison to the problem of data exfiltration. The only example I know of is the case of an ISP injecting online advertising into web pages. When an ISP attempted to inject ads into HTTP, the public responded. The ISP was caught out, immediately. However with data exfiltration protected from public scrutiny via HTTPS, Google can continue to avoid such public objection. Whether it is an ISP injecting ads or Google collecting data to provide services to others who want to inject "personalised" ads, the goal is the same: to profit from annoying users with online ads. Unlike speculative problems of eavesdropping and data manipulation associated with 5-10% of Chrome traffic using HTTP, the amount of useful commercial surveillance data being exiltrated from Chrome is a real and daily occurrence for hundreds of millions of computer users. Chrome's TLS roadblocks and warnings to prevent any and all computer users from acting as their own certificate authorities in order to monitor the traffic from their computers via Chrome are especially dubious. Please do not misinterpret this comment. I am not against TLS or HTTPS. I am in favour of respecting the choice of some users to act as their own CAs in certain situations, for certain purposes. I am against "forced delegation of trust". Everyone has a right to trust themselves as opposed to completely delegating all trust to Google and the commercial CA business. This should be a choice made by the computer user, not Google. Trust is a two-way street. If computer users "trust" Google, then Google must trust computer users.

3y ago

joerick 3y ago

While I support the cause, HTTPS is the biggest thing obsoleting old devices in my experience. Currently hitting this with an old eink project that's based on an obsolete ereader. I wonder if there's some kind of proxy I could connect to over HTTP that does the modern HTTPS on my behalf. (I'm aware of the security implications, just want it to get a tweet/weather forecast)

xacky 3y ago

Hopefully Chromium starts wanting ipv6 by default as well and starts putting a warning message on websites still using ipv4 in 2023 too. We are almost at 50% ipv6 usage according to Google, time to start pressuring the laggards.

p1mrx 3y ago
Try the IPvFoo extension.

chromoblob 3y ago

> Chrome will automatically upgrade all http:// http:// navigations to https:// https://, even when you click on a link that explicitly declares http:// http://. https: and http: authorities are totally unrelated. Here, https: server will receive and reply to requests that were intended by websites to go to http:, which is dangerous if the two servers aren't controlled by the same author. All in all, an insane change.