Slashdot Mirror
Google Chrome Begins Warns Users About Insecure Pages (certsimple.com)
An anonymous reader shares an article on CertSimple, a firm that helps companies prove their identity on their websites: Today Chrome's stable channel was updated with a new HTTPS UI. The changes in these versions of Chrome (Chrome 53 for Windows, Mac users got them in Chrome 52) complete 'transition 1' in Google's HTTPS plans, first announced in December 2014: T1: Non-secure origins marked as Dubious. In other words: Chrome now explicitly tells users non-HTTPS sites aren't private. If a Chrome user visits a site that isn't private -- for example, there's no HTTPS, broken HTTPS, or HTTPS only on 'checkout' pages -- Chrome now displays a mid-grey colored info box.
"Google Chrome Begins Warns Users About Insecure Pages"
Good work, editors.
Google is a spyware company. Chrome is their spawn. You are their product.
Many public wifis have a page they redirect you to. And they will redirect on https as well. You have to tell your browser that you trust the page but there should be a better way to do the public wifi messages. Browser developers and wifi redirect engineers need to talk and should be able to develop a means of notifying user without making it incredibly difficult to accept.
And thus people will start seeing the "dubious" mark in the UI when accessing the web-based administration interface of a home router, a home NAS, or a home network printer, which lacks HTTPS because it lacks a certificate, in turn because it lacks a globally unique fully qualified domain name.
Or should a device maker instead deploy the same wildcard certificate with the same private key on all of a given make and model?
Why can't public Wi-Fi use something like RADIUS, or at least a pre-shared key changed daily and posted on all cash registers, instead of a captive portal?
Eyenot User Begins Just Smashing The Fuck Out Of This Headline With A Hammer
"Stratigraphically the origin of agriculture and thermonuclear destruction will appear essentially simultaneous" -- Lee
I'm not using Chrome. What's up Slashdot? Is this a time stamp thing?
“He’s not deformed, he’s just drunk!”
I used to think that maybe this kind of thing was a good idea, but I've changed my mind. There are all sorts of reasons you might not want to use HTTPS for a website, usually revolving around the fact that it is just a pain in the ass to set up and maintain (especially if you run your own server). It's often overkill during development, or in a situation where you're piggybacking on an already-secure connection like SSH.
I suspect this is all to do with the desire of big corporations like Google to make the web more of a place for people with $$$. The money and time to setup and maintain SSL infrastructure.
And yeah I know you can use Let's Encrypt... if you're happy to put up with ludicrously short certificate expiration times, or install their software on your server and configure it to work with whatever you're serving your certs with (good luck if it's not Apache). But that sucks, frankly.
== Jez ==
Do you miss Firefox? Try Pale Moon.
Devices makers should arrange (and may need to pay) for their devices to obtain an Internet FQDN and self-issue a certificate from a CA.
Paying works so long as the device is actually hardware, as the price of a certificate can be built into the price of hardware. It wouldn't work so well if the "device" is a general-purpose computer, such as a PC, an Android device, or a Raspberry Pi board, running a particular application that is free software or otherwise distributed without charge.
in exchange for, let's say $5000 plus $1000 per year for at least the three year intended lifespan of the product.
Which would leave Slashdot's comment section even more up in arms about "planned obsolescence" once the three years run out.
Try reading it like this, "Google Chrome Warns Begins ...." What a terrible turn of phrase, get it together editors.
Google Chrome Begins Warns Users
Come on, manishs, I know it's after beer thirty on a holiday weekend, but good grief -- this would take about 30 seconds to fix.
Chrome was one of the first to hide the "http://" prefix.
That is exactly what "http://" means: no encryption, no authentication.
And of course, some other browsers started to copy chrome in this regard.
Stop hiding important information from the user!!!
The browser UI was perfect around firefox 25 or so. It's gone downhill since.
Honestly,
- If you run a webserver, go get yourself letsencrypt, use cloudflare or namecheap has cheap ssl.
- Enable http2 on nginx (if you are using it, use it well)
- Enjoy faster loading time.
Your welcome.
- The argument against https is pointless.
Let me rephrase that:
Honestly,
- If you run a webserver, install this software, just trust us it's fine; redelegate your DNS to this company with-whom-I'm-totally-not-involved so they proxy all your connections and know who's visiting your site (and can sell or hand it over to whatever TLA you like); or pay money to another organisation for a set of we-promise-they're-unique-and-secure-numbers and we would totally never be compromised or behave unethically [cough] Symantec [cough] DigiNotar [cough] Verisign [hack] [cough];
- Do it my way because spinach and everything supports enforced HTTPS, and the peons can do without
- Don't worry that your data usage just doubled for HTTPS, it's only $50 a month extra for the upgraded plan and everyone can get gigabit fiber anyway.
You'rE unwelcome here.
- The argument against https is my-way-or-the-highway so screw you.
There, I think I covered it all.
Here we have still unencrypted pages that ask for the single sign on login information. And IT say that's ok, because the HTML POST request is sent off over https...
I assume Google Chrome would think otherwise.
a particular application that is free software or otherwise distributed without charge.
For the DIY stuff you already can just use Let's Encrypt. [...] contributing button push "Make sure the machine has an actual FQDN then press this button" one click SSL setup
The "Make sure the machine has an actual FQDN" is the hard part. Each user of an application will have to buy a domain, keep the domain renewed, buy dynamic DNS service for that domain to publish the required TXT record, and keep the dynamic DNS service renewed. Many domain registrars bundle basic DNS service with domain registration, but it's often not dynamic; a user has to edit the zone file through a web form. The application's developer can't just buy its own domain, give subdomains to users, and let all users of that application obtain certificates for those subdomains, because of the rate limit of Let's Encrypt. This means that if an application gets a million users, a million domains will need to be registered, which breaks the "distributed without charge" constraint.
It's the difference between the person whose WiFi network is named "I Can't Even" and the person whose WiFi network is named "FooCom-E5B206". The latter person probably doesn't even know what an ESSID is, and doesn't care how to change it, but auto-naming is better than the situation where every other WiFi network is called "Netgear".
But who would pay for the renewal of foocom-e5b206.net after the device's warranty expires?
Google Chrome Begins Warns Users About Insecure Pages
I've always wished for a job that involved no manual labor and no mental labor.
I'm an American. I love this country and the freedoms that we used to have.
http vs https in the Adressbar were never a good indicator. People do not want to know if its http or https, they want to know if its secure or not.
And we nerds should acknowlege, that http, spdy, http2, gopher or ftp should be the same for a transport protocol and the user does not need to care, but if its ftp or ftps is important to him.