4 ms·

>For the past several years, more than 90% of Chrome users' navigations have been to HTTPS sites, How do they know this? That's frightening. I guess that's par

>For the past several years, more than 90% of Chrome users' navigations have been to HTTPS sites, How do they know this? That's frightening. I guess that's part of why they're so okay with going to HTTPS only; it apparently doesn't stop them from snooping. Adding scaremongering annoyance click-throughts for connections to HTTP is bad too. Much like how the megacorp browsers have made HTTPS self-signed sites unvisitable it looks like they're trying to make HTTP sites unvisitable too. This will not be a problem for for-profit and institutional sites but it'll make most of the old, non-commercial web unvisitable for chrome users. I'm not against HTTPS or HTTPS by default. I think that's a good idea. But stopping people from visiting HTTP sites is something that only makes sense in some contexts. Doing it universally will make the web a much smaller, more profit oriented space (at least for chrome users).

CharlesW 3y ago
> How do they know this? I'd assume through ga.js (and urchin.js).
Lt_Riza_Hawkeye 3y ago
> How do they know this? I believe the setting "Make searches and browsing better" (subtitle "Send URLs of pages you visit to google") under chrome://settings/syncSetup is on by default if you don't manually uncheck the send usage data checkbox when installing
kuratkull 3y ago
Chrome is an extension of Googles ad empire, it spies in you.
bluefishinit 3y ago
> How do they know this? That's frightening. It's very frightening, and it's the end result of opt-out telemetry "to make the product better". There are certain pieces of software that should never have telemetry: your OS, your web browser, your terminal, your email client... I choose software written by craftspeople with an opinion who don't "need" telemetry, not software that's just a conduit to hoover up my personal and sensitive data.
- insanitybit 3y ago
  Is "percentage of sites visited that are HTTP vs HTTPS" "personal" or "sensitive" to you? And if so... how?
  - bluefishinit 3y ago
    Yes, all of my data is sensitive to me. I don't want Google knowing anything about me, including when I use their software.
    - insanitybit 3y ago
      [flagged]
      - bluefishinit 3y ago
        Well, I think you're a frog being boiled if you feel that way. My privacy is important to me.
franky47 3y ago
Even without snooping on domains (let alone entire URLs), it would be feasible to only observe the protocol part of `window.location` and send it as anonymized telemetry. But who am I kidding, given who we're talking about, I doubt that's what's happening.
kmeisthax 3y ago
The snooping is literally just Chrome saying "I've visited 95 pages, 90 of which were encrypted." None of that violates HTTPS's security guarantees; the fact that you are using encryption is not a secret in HTTPS. This isn't scaremongering. Go on any kind of public Wi-Fi and see what horrors the network does to your unencrypted traffic (and how those horrors can get cached and persist when you leave the network). It's actually kind of bonkers that we spent a decade treating unsigned HTTPS as less secure than unencrypted HTTP. As for non-commercial sites, we've had Lets Encrypt for almost a decade at this point. It's literally free, and it's really all you need. There is no excuse for any public facing website with a fully-qualified domain name to not have encryption anymore. As far as I'm aware Chrome isn't trying to ban HTTP connections. All they're doing is giving you a warning. Hell, they're actually making things easier on the old web by doing automatic upgrades. So you don't even need to change your old HTML files, you just need to ensure that you have a cert setup in your server configuration.
- superkuh 3y ago
  No on is advocating for HTTP only. We're saying webservers should be HTTP+HTTPS.
- ghusto 3y ago
  > As for non-commercial sites, we've had Lets Encrypt for almost a decade at this point Saying there's "no excuse" to not have HTTPS is presuming there's a benefit in 100% of cases to have it in the first place. I don't want my internal sites breaking because a cert couldn't be updated, on something that didn't need it in the first place. There are even external sites I run that I could argue don't need it.
  - hsbauauvhabzb 3y ago
    Just imagine 10-year-old-us trying to build a website now, and some megacorp slapping us down and saying ‘No TLS no excuse!’
    - unmole 3y ago
dadrian 3y ago
It is publicly available data from Chrome's non-URL keyed metrics system. https://transparencyreport.google.com/https/overview?hl=en https://transparencyreport.google.com/https/overview?hl=en

CharlesW 3y ago

> How do they know this? I'd assume through ga.js (and urchin.js).

Lt_Riza_Hawkeye 3y ago

> How do they know this? I believe the setting "Make searches and browsing better" (subtitle "Send URLs of pages you visit to google") under chrome://settings/syncSetup is on by default if you don't manually uncheck the send usage data checkbox when installing

kuratkull 3y ago

Chrome is an extension of Googles ad empire, it spies in you.

bluefishinit 3y ago

> How do they know this? That's frightening. It's very frightening, and it's the end result of opt-out telemetry "to make the product better". There are certain pieces of software that should never have telemetry: your OS, your web browser, your terminal, your email client... I choose software written by craftspeople with an opinion who don't "need" telemetry, not software that's just a conduit to hoover up my personal and sensitive data.

insanitybit 3y ago
Is "percentage of sites visited that are HTTP vs HTTPS" "personal" or "sensitive" to you? And if so... how?
- bluefishinit 3y ago
  Yes, all of my data is sensitive to me. I don't want Google knowing anything about me, including when I use their software.
  - insanitybit 3y ago
    [flagged]
    - bluefishinit 3y ago
      Well, I think you're a frog being boiled if you feel that way. My privacy is important to me.

franky47 3y ago

Even without snooping on domains (let alone entire URLs), it would be feasible to only observe the protocol part of `window.location` and send it as anonymized telemetry. But who am I kidding, given who we're talking about, I doubt that's what's happening.

kmeisthax 3y ago

The snooping is literally just Chrome saying "I've visited 95 pages, 90 of which were encrypted." None of that violates HTTPS's security guarantees; the fact that you are using encryption is not a secret in HTTPS. This isn't scaremongering. Go on any kind of public Wi-Fi and see what horrors the network does to your unencrypted traffic (and how those horrors can get cached and persist when you leave the network). It's actually kind of bonkers that we spent a decade treating unsigned HTTPS as less secure than unencrypted HTTP. As for non-commercial sites, we've had Lets Encrypt for almost a decade at this point. It's literally free, and it's really all you need. There is no excuse for any public facing website with a fully-qualified domain name to not have encryption anymore. As far as I'm aware Chrome isn't trying to ban HTTP connections. All they're doing is giving you a warning. Hell, they're actually making things easier on the old web by doing automatic upgrades. So you don't even need to change your old HTML files, you just need to ensure that you have a cert setup in your server configuration.

superkuh 3y ago
No on is advocating for HTTP only. We're saying webservers should be HTTP+HTTPS.
ghusto 3y ago
> As for non-commercial sites, we've had Lets Encrypt for almost a decade at this point Saying there's "no excuse" to not have HTTPS is presuming there's a benefit in 100% of cases to have it in the first place. I don't want my internal sites breaking because a cert couldn't be updated, on something that didn't need it in the first place. There are even external sites I run that I could argue don't need it.
- hsbauauvhabzb 3y ago
  Just imagine 10-year-old-us trying to build a website now, and some megacorp slapping us down and saying ‘No TLS no excuse!’
  - unmole 3y ago

dadrian 3y ago

It is publicly available data from Chrome's non-URL keyed metrics system. https://transparencyreport.google.com/https/overview?hl=en https://transparencyreport.google.com/https/overview?hl=en