3 ms·
We are. Slowly, due to lots of legacy, but surely getting there. See the small steps over the years where it was first an add-on to force https-only mode (Http
by Aachen 2y ago
We are. Slowly, due to lots of legacy, but surely getting there.
See the small steps over the years where it was first an add-on to force https-only mode (HttpsEverywhere, 2011), then browsers started showing insecure symbols for http connections (e.g. in 2019: https://blog.mozilla.org/security/2019/10/15/improved-security-and-privacy-indicators-in-firefox-70/ https://blog.mozilla.org/security/2019/10/15/improved-securi...), and more recently I think browsers are starting to try https before http when you don't specify the protocol. I've also seen a mention of strict https mode or something, not sure if that's a private navigation feature or something yet to come, but warning screens equivalent to insecure certificate pages are getting there
- Dylan16807 2y agoChrome's version of trying https first sure is annoying though. If a site is down entirely, when chrome can't connect to port 443 it confidently declares that "the connection is not secure because this site does not support https" and gives a "continue" button. Then when you click "continue" nothing happens for a while before it finally admits there's nothing responding at all. So it gives a misleading error and takes longer to figure out if a site is actually down.
- jraph 2y agoI'm highly surprised by this. It seems very dumb and I have never seen anything like this, though I never use Chrome and very rarely fire Chromium for testing something. Is there something to read about this, like a dev ticket?
- Dylan16807 2y agoThere might be but I'm not aware of any tickets. But if you open chrome and navigate to 192.168.20.20 you should see it. Or any domain that resolves to a non-responsive IP, if you have one in mind.
- jraph 2y agoJust tried on Chromium, I get ERR_ADDRESS_UNREACHABLE as I would expect.
- Dylan16807 2y agoYeah, someone else said it's not enabled for everyone. It might just be settings? Do you have "Always use secure connections" turned on? I don't remember if that was a manual toggle or not. However it's triggered, I hope they make the UI better before they deploy it more widely. And I'll quote the exact text for you: [warning triangle] The connection to 192.168.0.40 is not secure You are seeing this warning because this site does not support HTTPS. Learn more [Continue to site] [Go back] Then when I click continue, the only sign it's doing anything is that the reload arrow becomes a stop X. After 20 seconds it moves on to "This site can't be reached".
- jraph 2y agoYep, indeed I'm seeing this if I enable this option.
- o11c 2y agoFirefox has a similar bug, but for DNS rather than connection.
- plorkyeran 2y agoI have never seen this happen in Chrome. I just tried it to make sure I wasn't crazy and it did indeed go straight to telling my that the connection timed out without showing a security error first.
- hirsin 2y agoThis is only enabled for a small percent of people at random, otherwise just folks in the advanced protection program.