14 ms·

This globally-enforced move to HTTPS is killing the security and privacy for home projects and intranet-hosted websites. If Google forces HTTPS everywhere, and

This globally-enforced move to HTTPS is killing the security and privacy for home projects and intranet-hosted websites. If Google forces HTTPS everywhere, and refuses to accept "self signed HTTPS certs", then there is no path left for security-camera/home-automation/staticIP-family-websites without being forced into going over the internet. I can't even show my projects to my non-technical friends without looking like some scammer because of these dumb warning messages plastered all over their browsers on my own wifi! Chrome team: Either start accepting self-signed certs for LAN, or drop forced HTTPS for intranet altogether -- I DO NOT want to put my family's or my personal-project data on the internet!

stavros 3y ago
> I DO NOT want to put my family's or my personal-project data on the internet! Use Firefox?
- jjkeddo199 3y ago
  Its not as easy as you think to convince your friends/family to install new web browsers. Websites should just work
  - stavros 3y ago
    Websites do just work, the browser doesn't. "You can't access the internal LAN because your browser is bad" should be a compelling reason for them to change.
    - jjcm 3y ago
      A non-technical user doesn’t know that. They just know a site isn’t displaying correctly.
    - NegativeK 3y ago
      "Why do I need to change my internet thing?" "Because Chrome is enforcing security standards that--" "I don't care anymore. I'll keep using the internet I use now."
      - stavros 3y ago
        "You can, you just can't use that site any more."
deleted 3y ago
[deleted]
bradley13 3y ago
This. Also, plain old http is appropriate for many project is and many websites. Sure, https first, but let's not make it https only.
- xg15 3y ago
  "HTTPS only" is Google's end goal though. There is already the rule that all new web features are only enabled for https. As they write in the OP, it's possible that plaintext http will even lose features in the future that are still supported currently, like long-lived cookies.
janosdebugs 3y ago
Are you saying that you can't create a self-signed CA that Chrome will trust when configured to do so? Personally, I'm using Letsencrypt with DNS validation for internal projects. A wildcard certificate that needs to be renewed every 3 months for a domain does the trick, the servers themselves don't need to be on the Internet, just have a domain-based name. (I have some Ansible automation behind it.)
- born2discover 3y ago
  That sounds intriguing, could you please elaborate?
  - janosd 3y ago
    I assume you are interested in the Letsencrypt part. Basically, I'm running an Ansible script on my computer, which creates an account key, the server key and requests a certificate. The server key and the certificate are then distributed to the servers that need them, leaving the original account key only on my machine. The Letsencrypt verification happens via my DNS provider, which happens to have an Ansible module. Here's the source code: [link redacted]
- jjkeddo199 3y ago
  Is there a way to do this for default Chrome installs? The whole point of hosting something for LAN is so family members can use the site on a whim from their iphone.
  - janosdebugs 3y ago
    AFAIK Chrome uses the OS certificate store, so you should just need to provision your CA in the OS itself. For iPhones you may be able to use configuration profiles, which are also useful if you want to set up stuff like email accounts, etc. However, it's been a while since I made on of those, so I don't know if you can use it for certificates. You may have better luck with Letsencrypt instead.
    - 3y ago
andrewxdiamond 3y ago
“Not Self-signed” and “on the internet” are not the same thing. You can get a cert for a domain that you only use on your intranet. The only public thing about it is the domain registration. You can even use Lets Encrypt to get that cert for no cost. You just need to own a domain
- jjkeddo199 3y ago
  This is interesting to me. How would the DNS work without touching the internet? Or do you mean to say that only DNS touches the internet and rest of the site would be offline? If I made some cool security-camera image-recognition project with YOLO and wanted to sell installs to my friends in the area, would I need touch their DNS settings too? Personally: I feel uncomfortable changing settings on other folk's routers. If I could get away with helping them set a static IP without touching anything else, I'd much prefer it.
  - ggpsv 3y ago
    The site can be served only within your local or private networks and use HTTPS. The certificate is issued using a DNS challenge, for a domain that you own.
  - isclever 3y ago
    You can buy a domain, put public NS servers on it for the only purpose of doing Letsencrypt DNS validation. Hint: Create root and wildcard (eg domain.ca and *.domain.ca) so you aren't leaking internal DNS records (not that it matters much). You run an internal DNS server (Pihole + unbound is my combo of choice) which becomes authoritative for your internal LAN.
  - lolinder 3y ago
    You can have a local DNS server that tells computers on your network where to find intranet-hosted applications. I use my Pihole for that purpose, but you can set up a regular DNS server just as easily. In my case, my router just has a setting for what DNS server to use, and I point it at my local DNS instead of 1.1.1.1 or whatever.
Avamander 3y ago
If you own a domain it's trivial to request a certificate for it using just DNS. There's no need to expose anything to the internet.
jsiepkes 3y ago
If you don't want TLS warnings then just create the certificates from a single (self-signed) root CA and deploy the CA certificate in your local Chrome, Windows, etc. As an added bonus you get actual security. Since anyone can just recreate your self signed certificates currently because no one bothers to check them. For example something like this: https://arminreiter.com/2022/01/create-your-own-certificate-authority-ca-using-openssl/ https://arminreiter.com/2022/01/create-your-own-certificate-...
- hsbauauvhabzb 3y ago
  So somebody who doesn’t know what they’re doing should roll out PKI, which if compromised would result in the ability to inspect encrypted payloads for all websites they visit, including banking. Because there’s no excuse for not TLS. Got it.
- xg15 3y ago
  Yes, that's nice and all if you only want to access the server from your personal phone/laptop/etc. It doesn't help at all if you want to show the server to others.
xnyan 3y ago
>I DO NOT want to put my family's or my personal-project data on the internet! DNS-01 challenges addresses this, the webserver never needs to be exposed to the internet. >I can't even show my projects to my non-technical friends without looking like some scammer How would the alternative work? If https enforcement can be disabled server side without a notification to the user, what is the point of https? If it's something that can be set on the user side, how would it be substantively different than the user accepting a self-signed certificate?
- xg15 3y ago
  > How would the alternative work? It's not an easy problem to solve, but I think it would be possible to extend PKI to make it work for local networks without internet access. An approach could work as follows: Dedicate a special TLD for "local-only domains". Such domains are only expected to be valid inside a specific LAN, analogous to 192.168.* IP addresses. (In fact, several TLDs with that kind of intended use already exist [1]) Specify some way how a local network can announce a CA specifically for that network (maybe through a DHCP extension, a special "well-known" hostname or IP address or a field in a wifi beacon message) When a user navigates to a local-only domain, the site's cert is validated using the network's CA. The CA is only valid for local-only domains and only while connected to that specific network. This would allow using PKI and encrypted connections inside a LAN, would not require internet access or 3rd party services and would also not compromise the security of domains on the internet. [1] https://unix.stackexchange.com/questions/92441/whats-the-difference-between-local-home-and-lan#92517 https://unix.stackexchange.com/questions/92441/whats-the-dif...
  - janosdebugs 3y ago
    Several problems with this proposal: 1. Who defines what the local network is and why should this environment be trusted more? The IP address doesn't guarantee that the packets won't be going round the globe 3 times. 2. You are proposing a whole new, as of yet unresearched verification mechanism to TLS, which won't be supported by a whole lot of devices for a long time. I just had to downgrade a server of mine to TLS 1.2 because a high profile software couldn't deal with 1.3. 3. DHCP is inherently insecure and setting up a rogue AP is also not too difficult outside of an enterprise environment where certificate rollout is already not a problem. Ideal for hijacking an intranet connection covertly. 4. The proposed CA would not have the benefit of public transparency logs, so it would not meet the minimum requirements currently set forth by the browsers to trust a CA. 5. What happens if you are connected to more than one network at a time? Which one gets authority over the special TLD? 6. Who guarantees that the connected client uses the mandated DNS servers to resolve the special domain? This is not a viable proposal for more than a handful of cases, but makes it a lot less secure for everyone else.
8organicbits 3y ago
This is one of the concerns that lead me to build getlocalcert.net. You don't need to expose your home network to the Internet, you don't need to buy your own domain name, you don't need to convince your friends to install a private CA, and it doesn't cost any money. Check us out: https://www.getlocalcert.net/ https://www.getlocalcert.net/
xinayder 3y ago
They also updated Chrome a long time ago to stop showing which protocol you are using on the address bar, which IMO is a very stupid decision. I want to know if the site I'm accessing has HTTPS by looking at the URL, I never asked someone to hide the protocol part of it. Okay, there's the green padlock, but still, I want my full URL, I don't want my browser to hide my URLs.
- Scion9066 3y ago
  You can right click on the address bar and check the option "Always show full URLs" if you want to see the protocol still. They're making these changes for the average user who doesn't know the difference and who can't tell if a site is secure or not based on the protocol part (or who misinterpret what it means in terms of security vs trustworthiness). The padlock is no longer green in Chrome and will be going away next month too. The states will just be secure (no warnings) or not secure (displaying a warning). It shouldn't be something people have to think about in this day and age unless there is a problem (e.g. cert expired, cert mismatch, not encrypted at all) as sites should just be secure by default.
deleted 3y ago
[deleted]
deblasioj 3y ago
Blog post author here. I didn't talk about this in the post mostly for brevity, but the challenge of HTTPS on local networks is absolutely on our radar. We're still evaluating what the right strategy is for addressing it, but we definitely _are not_ going to show big scary warnings on all local network access or otherwise make them inaccessible.

stavros 3y ago

> I DO NOT want to put my family's or my personal-project data on the internet! Use Firefox?

jjkeddo199 3y ago
Its not as easy as you think to convince your friends/family to install new web browsers. Websites should just work
- stavros 3y ago
  Websites do just work, the browser doesn't. "You can't access the internal LAN because your browser is bad" should be a compelling reason for them to change.
  - jjcm 3y ago
    A non-technical user doesn’t know that. They just know a site isn’t displaying correctly.
  - NegativeK 3y ago
    "Why do I need to change my internet thing?" "Because Chrome is enforcing security standards that--" "I don't care anymore. I'll keep using the internet I use now."
    - stavros 3y ago
      "You can, you just can't use that site any more."

deleted 3y ago

[deleted]

bradley13 3y ago

This. Also, plain old http is appropriate for many project is and many websites. Sure, https first, but let's not make it https only.

xg15 3y ago
"HTTPS only" is Google's end goal though. There is already the rule that all new web features are only enabled for https. As they write in the OP, it's possible that plaintext http will even lose features in the future that are still supported currently, like long-lived cookies.

janosdebugs 3y ago

Are you saying that you can't create a self-signed CA that Chrome will trust when configured to do so? Personally, I'm using Letsencrypt with DNS validation for internal projects. A wildcard certificate that needs to be renewed every 3 months for a domain does the trick, the servers themselves don't need to be on the Internet, just have a domain-based name. (I have some Ansible automation behind it.)

born2discover 3y ago
That sounds intriguing, could you please elaborate?
- janosd 3y ago
  I assume you are interested in the Letsencrypt part. Basically, I'm running an Ansible script on my computer, which creates an account key, the server key and requests a certificate. The server key and the certificate are then distributed to the servers that need them, leaving the original account key only on my machine. The Letsencrypt verification happens via my DNS provider, which happens to have an Ansible module. Here's the source code: [link redacted]
jjkeddo199 3y ago
Is there a way to do this for default Chrome installs? The whole point of hosting something for LAN is so family members can use the site on a whim from their iphone.
- janosdebugs 3y ago
  AFAIK Chrome uses the OS certificate store, so you should just need to provision your CA in the OS itself. For iPhones you may be able to use configuration profiles, which are also useful if you want to set up stuff like email accounts, etc. However, it's been a while since I made on of those, so I don't know if you can use it for certificates. You may have better luck with Letsencrypt instead.
  - 3y ago

andrewxdiamond 3y ago

“Not Self-signed” and “on the internet” are not the same thing. You can get a cert for a domain that you only use on your intranet. The only public thing about it is the domain registration. You can even use Lets Encrypt to get that cert for no cost. You just need to own a domain

jjkeddo199 3y ago
This is interesting to me. How would the DNS work without touching the internet? Or do you mean to say that only DNS touches the internet and rest of the site would be offline? If I made some cool security-camera image-recognition project with YOLO and wanted to sell installs to my friends in the area, would I need touch their DNS settings too? Personally: I feel uncomfortable changing settings on other folk's routers. If I could get away with helping them set a static IP without touching anything else, I'd much prefer it.
- ggpsv 3y ago
  The site can be served only within your local or private networks and use HTTPS. The certificate is issued using a DNS challenge, for a domain that you own.
- isclever 3y ago
  You can buy a domain, put public NS servers on it for the only purpose of doing Letsencrypt DNS validation. Hint: Create root and wildcard (eg domain.ca and *.domain.ca) so you aren't leaking internal DNS records (not that it matters much). You run an internal DNS server (Pihole + unbound is my combo of choice) which becomes authoritative for your internal LAN.
- lolinder 3y ago
  You can have a local DNS server that tells computers on your network where to find intranet-hosted applications. I use my Pihole for that purpose, but you can set up a regular DNS server just as easily. In my case, my router just has a setting for what DNS server to use, and I point it at my local DNS instead of 1.1.1.1 or whatever.

Avamander 3y ago

If you own a domain it's trivial to request a certificate for it using just DNS. There's no need to expose anything to the internet.

jsiepkes 3y ago

If you don't want TLS warnings then just create the certificates from a single (self-signed) root CA and deploy the CA certificate in your local Chrome, Windows, etc. As an added bonus you get actual security. Since anyone can just recreate your self signed certificates currently because no one bothers to check them. For example something like this: https://arminreiter.com/2022/01/create-your-own-certificate-authority-ca-using-openssl/ https://arminreiter.com/2022/01/create-your-own-certificate-...

hsbauauvhabzb 3y ago
So somebody who doesn’t know what they’re doing should roll out PKI, which if compromised would result in the ability to inspect encrypted payloads for all websites they visit, including banking. Because there’s no excuse for not TLS. Got it.
xg15 3y ago
Yes, that's nice and all if you only want to access the server from your personal phone/laptop/etc. It doesn't help at all if you want to show the server to others.

xnyan 3y ago

>I DO NOT want to put my family's or my personal-project data on the internet! DNS-01 challenges addresses this, the webserver never needs to be exposed to the internet. >I can't even show my projects to my non-technical friends without looking like some scammer How would the alternative work? If https enforcement can be disabled server side without a notification to the user, what is the point of https? If it's something that can be set on the user side, how would it be substantively different than the user accepting a self-signed certificate?

xg15 3y ago
> How would the alternative work? It's not an easy problem to solve, but I think it would be possible to extend PKI to make it work for local networks without internet access. An approach could work as follows: Dedicate a special TLD for "local-only domains". Such domains are only expected to be valid inside a specific LAN, analogous to 192.168.* IP addresses. (In fact, several TLDs with that kind of intended use already exist [1]) Specify some way how a local network can announce a CA specifically for that network (maybe through a DHCP extension, a special "well-known" hostname or IP address or a field in a wifi beacon message) When a user navigates to a local-only domain, the site's cert is validated using the network's CA. The CA is only valid for local-only domains and only while connected to that specific network. This would allow using PKI and encrypted connections inside a LAN, would not require internet access or 3rd party services and would also not compromise the security of domains on the internet. [1] https://unix.stackexchange.com/questions/92441/whats-the-difference-between-local-home-and-lan#92517 https://unix.stackexchange.com/questions/92441/whats-the-dif...
- janosdebugs 3y ago
  Several problems with this proposal: 1. Who defines what the local network is and why should this environment be trusted more? The IP address doesn't guarantee that the packets won't be going round the globe 3 times. 2. You are proposing a whole new, as of yet unresearched verification mechanism to TLS, which won't be supported by a whole lot of devices for a long time. I just had to downgrade a server of mine to TLS 1.2 because a high profile software couldn't deal with 1.3. 3. DHCP is inherently insecure and setting up a rogue AP is also not too difficult outside of an enterprise environment where certificate rollout is already not a problem. Ideal for hijacking an intranet connection covertly. 4. The proposed CA would not have the benefit of public transparency logs, so it would not meet the minimum requirements currently set forth by the browsers to trust a CA. 5. What happens if you are connected to more than one network at a time? Which one gets authority over the special TLD? 6. Who guarantees that the connected client uses the mandated DNS servers to resolve the special domain? This is not a viable proposal for more than a handful of cases, but makes it a lot less secure for everyone else.

8organicbits 3y ago

This is one of the concerns that lead me to build getlocalcert.net. You don't need to expose your home network to the Internet, you don't need to buy your own domain name, you don't need to convince your friends to install a private CA, and it doesn't cost any money. Check us out: https://www.getlocalcert.net/ https://www.getlocalcert.net/

xinayder 3y ago

They also updated Chrome a long time ago to stop showing which protocol you are using on the address bar, which IMO is a very stupid decision. I want to know if the site I'm accessing has HTTPS by looking at the URL, I never asked someone to hide the protocol part of it. Okay, there's the green padlock, but still, I want my full URL, I don't want my browser to hide my URLs.

Scion9066 3y ago
You can right click on the address bar and check the option "Always show full URLs" if you want to see the protocol still. They're making these changes for the average user who doesn't know the difference and who can't tell if a site is secure or not based on the protocol part (or who misinterpret what it means in terms of security vs trustworthiness). The padlock is no longer green in Chrome and will be going away next month too. The states will just be secure (no warnings) or not secure (displaying a warning). It shouldn't be something people have to think about in this day and age unless there is a problem (e.g. cert expired, cert mismatch, not encrypted at all) as sites should just be secure by default.

deleted 3y ago

[deleted]

deblasioj 3y ago

Blog post author here. I didn't talk about this in the post mostly for brevity, but the challenge of HTTPS on local networks is absolutely on our radar. We're still evaluating what the right strategy is for addressing it, but we definitely _are not_ going to show big scary warnings on all local network access or otherwise make them inaccessible.