6 ms·

How long before browsers default to HTTPS-first, so they don't have to carry around a hefty preload list?

• Someone1234 11y ago
  How long until websites stop hosting broken HTTPS sites with certificate errors? Same answer. I use HTTPS Everywhere, you'd be surprised how many sites are broken by default in HTTPS.
  • nodesocket 11y ago
    Hackernews is one of them. I'm showing broken https in Chrome (43.0.2357.130). "This site uses a weak security configuration (SHA-1 signatures), so your connection may not be private."
    • Someone1234 11y ago
      I am unable to reproduce. I am seeing SHA256. Are you being MitM-ed perhaps by your employer/school?
      • nodesocket 11y ago
        See screenshot: http://i.imgur.com/m5sVoPf.png http://i.imgur.com/m5sVoPf.png
        • gcp 11y ago
          We'll need to see the certification chain. I agree with the other commenters this is suspect; not seeing any SHA-1 certs in the chain either.
          • nodesocket 11y ago
            I just tried on my MacBook pro on another network, and don't see the warning now. I'll need to go back to my iMac and find the certificate chain.
          • nodesocket 11y ago
            I just tried on my MacBook pro on another network, and don't see the warning now. I'll need to go back to my iMac and find the certificate chain.
    • drv 11y ago
      That's odd; the certificate I'm seeing for news.ycombinator.com has a SHA-256 signature, and the Qualsys test agrees.