Google Is Working On an HTTPS-Only Mode For Chrome (therecord.media) 65
An anonymous reader writes: Following in the footsteps of browsers like Mozilla Firefox and Microsoft Edge, Google Chrome is also in line to receive an HTTPS-Only Mode that will upgrade all unencrypted HTTP connections to encrypted HTTPS alternatives, where possible.
Currently, the new Chrome HTTPS-Only Mode is still under development in Chrome Canary distributions. Work is being done to add specific settings in the browser's interface, and no actual HTTP-to-HTTPS functionality is currently present. The feature is expected to be ready for Chrome 93, set to be released later this fall.
Currently, the new Chrome HTTPS-Only Mode is still under development in Chrome Canary distributions. Work is being done to add specific settings in the browser's interface, and no actual HTTP-to-HTTPS functionality is currently present. The feature is expected to be ready for Chrome 93, set to be released later this fall.
Only? (Score:5, Insightful)
"that will upgrade all unencrypted HTTP connections to encrypted HTTPS alternatives, where possible"
I don't think that word means what you think it means.
Re: (Score:2)
I'm not sure exactly what Chrome will offer, but in Firefox there are 3 choices:
HTTPS-Only Mode
HTTPS provides a secure, encrypted connection between Firefox and the websites you visit. Most websites support HTTPS, and if HTTPS-Only Mode is enabled, then Firefox will upgrade all connections to HTTPS.
Learn more [mozilla.org]
A simple substitution of HTTP:// to HTTPS:// is essentially how it is done. If it can't find the HTTPS then it will prompt the user to continue to HTTP. It's not true https-only mode, but rather a HTTPS first then prompt to continue on failure mode.
P.S. slashdot though my first draft was "ascii art", I had to remove some ironic hyphens. But somehow other accounts get total horseshit through, probably through the mobile APIs.
Re: (Score:2)
Indeed, I am not able to conceive what they mean by "upgrade all unencrypted HTTP connections to encrypted HTTPS alternatives, where possible".
I might as well read "upgrade all unencrypted HTTP connections to something else we control, in order to gather even more information about you, where possible".
I think what Google's really working on (Score:1)
Hooray for planned obsolescence (Score:2)
How many older machines are now utterly unusable because their root certificates expired and they basically can't browse the web anymore? I thought only Android devices were affected, but I spotted that on older Macs at work.
What would it have cost to build in a mechanism to keep updating the root certificates forever? Nothing, but hey, let's just find another way to get people to throw away their still usable hardware after 3 years...
Re: (Score:1)
Re: (Score:2)
I expect after https becomes mandatory they will try to phase out ipv4 as well. This combined with the Windows 11 fiasco.
Re:Hooray for planned obsolescence (Score:4, Funny)
I expect after https becomes mandatory they will try to phase out ipv4 as well.
Crap. I guess I'll have to go re-enable ipv6 in all the places I disabled.
Re: (Score:2)
to be fair, you can't re-install a computer without a USB stick or CD. the BIOS/EFI doesn't boot from the Internet (yet). While you're copying the obsolete OS setup files, maybe toss in a recent browser or some new root certificates.
Re: (Score:1)
Re: (Score:2)
Older Macs? What the hell is that? All Mac users are required to buy a whole new computer every five years! /sarcasm
Posted from a 2010 Mac mini.
Please hurry up with the next M1X/M2 Mac mini, Apple, this old Core 2 Duo is annoyingly slow in 2021.
Fucking Losers (Score:5, Informative)
Between Google pushing SSL down everyone's throat and Apple not accepting SSL certificates issued for over 398 days, I don't know which entity to hate more. This creates a ton of work for admins for many sites whose content does NOT need to be encrypted.
Also, before you jump down my throat with "Just use Let's Encrypt and have it automatically renew your certs", know that not everything that uses SSL is a web server.
Re: (Score:2)
We should demand that FTP and Gopher be added back into these browser.
But more seriously, I think it would be reasonable for unencrypted and self-signed certificates to default to having JavaScript disabled. I'd even be willing for there to be a legacy mode in these browser where it is limited to HTML 4.x/3.x and no fonts, script, or other nonsense. Keep the old internet working, while moving forward on the latest technology and security.
Re: (Score:1)
Re: (Score:2)
authoritarians would love a centrally controlled Internet where only people "on the list" can publish data. There is simply no need to encrypt, let alone sign, all information that passed through these wires.
Re: (Score:2)
actually for some of my personal domains I have web server that does nothing but renew the let's encrypt and then stuff into postfix cert file and restart for TLS mail. There are creative ways to use the free certs for other than web serving content.
Re: (Score:2)
Re: (Score:3)
there is alternative of working with LE by putting TXT record in DNS you control. Moving it to your on-internet server could be done by non-internet means, there are other ways of hooking up computers that have existed for decades like serial, bi-directional parallel, shared storage on non-tcp protocol... or non tcp/ip networking like decnet
dns-01 (Score:2)
The second method of ACME-challenges uses TXT records on your name server. github lists 173 repositories tagged dns-01 so there is some choise of examples
Re: (Score:2)
Re: (Score:2)
If you are using made-up TLDs for hostnames on an internal network, try these steps:
1. Create your own root certificate and intermediate certificate using OpenSSL or whatever else.
2. Trust the root certificate on all clients that connect to your internal network.
3. Use the intermediate certificate to issue server certificates.
Re: (Score:2)
we're talking about your nameserver though that is authoritative for your domain, you'll be putting TXT record in that for LE to side to see. How is that not perfect?
Re: (Score:2)
I know of several different organizations that use real DNS names for internal-only stuff. DNS names are registered and have NS servers listed but no other records are available on the internet. On the intranet where you can reach our internal DNS servers we've lots of A and CNAME records
Re: (Score:2)
That's an easy question. The answer is Microsoft, of course!
Re: (Score:2)
This creates a ton of work for admins for many sites whose content does NOT need to be encrypted.
You don't get to decide if someone is being persecuted for accessing your content. I'm happy that this is creating work for Admins. It's about time they realised that it's not up to them to decide if security is important for their users.
Re: (Score:3)
Re: (Score:2)
You're naïve to think that everyone is being persecuted by some ultra capable government agency. In other news I don't have a lock on my front door because I'm worried about James Bond breaking in.
Re: (Score:2)
You don't have an argument, if Kim Jung Jellybelly wants to make accessing a particular website a capital offence that part of the traffic isn't encrypted. Which particular manifesto you read or porn story or picture you looked at doesn't matter, you'll be standing on the X for the mortar shell.
Meanwhile, most the governments in the world don't give a shit what content you see, let's handle the majority and you neurotic people that worry about edge cases can shiver in your safe space.
Re: (Score:2)
You don't have an argument, if Kim Jung Jellybelly wants to make accessing a particular website a capital offence that part of the traffic isn't encrypted.
You're a special kind of retard if you think that's how it works. Or that you think we're talking about Kim Jung Jellybelly. While you accused me of "hollywood style" thinking, I encourage you to at least pull your head out of the sand (or your ass, if that's the dark ignorant place you stuck it).
Re: (Score:1)
Re: (Score:2)
> that not everything that uses SSL is a web server.
For those I use Acme's DNS mode and distribute the certs with devops. Pain to set up, once.
Re: (Score:2)
Not to mention the other little things people never talk about:
Re: (Score:2)
> Between Google pushing SSL down everyone's throat and Apple not accepting SSL certificates issued for over 398 days, I don't know which entity to hate more.
Why choose? Hate'em both, equally.
Now if only TLS was worth anything... (Score:5, Insightful)
Take a look at the list of CAs your browser blindly trusts.
I'll bet you money, you don't even know, let alone trust, most of them, and even consider some openly hostile.
TLS is all nice, if, and only if, it's your own CA and root certificate. Otherwise it's security theater and we just got lucky until now. ...mostly... we think ...
Then again, Chrome is Google's little tentacle sucker, so I'm probably being silly here. :)
Re: (Score:3)
Re: (Score:2)
While this is terrible, it's a feature the user should easily be aware of and be able to block.
For example, my company has internal CAs. I explicitly remove them as root ca and impose nameconstraints so they can't mess with internet traffic, even though they ostensibly don't try to do it, I don't trust them to have such a key. It's nice to have a web of trust with some features to manage it, and I can't think of another key management strategy that works for some third-party attestation. Without it, you a
Re: (Score:2)
There are two major bugs in TLS PKI.
1) Only one CA can authenticate a key. You cannot buy a certificate from 10 different providers for the same key. Enabling this would make it possible to remove the bad CAs, because sensible sites would be certified by multiple authorities. As it is, we are stuck with a year-long process to remove even the worst offenders. PGP does this much better.
2) CAs and intermediates have to be trusted for everything. If I like to have mycoolname.local on my internal network, I need
Re: (Score:2)
1) Absolutely, there is no emphasis on relative reputation of a CA and how it is represented in a browser, and no sane mechanism to have multi-authority signing
2) Well, there are nameconstraints. It's a pain because to actually implement it, each local user needs to make their own CA and use that to impose name constraints by cross-certifying, e.g. https://www.marcanoonline.com/... [marcanoonline.com]. Of course, a CA can constrain itself, but that's a bit silly since the consumer of the CA is more likely to want to pick how
Re: Now if only TLS was worth anything... (Score:1)
Nah, I'm systematically modded down by Slashdot admins.
Somehow I became their enemy, and now it almost did not matter what I say. Anything not buried below other comments, that was not cheering for what they wanted, got modded down.
Seems they do not understand that any criticism is only me wishing things were better. For everyone. Including them. They always seem to think I want to harm them or hate then.
Maybe cultural differences lost in translation...
I learned to just look for better communities.
And wish
Re: (Score:2)
true, it's mostly a scheme for lining the pockets of certain corporations.
there are plenty of ways encryption and ID of site can be done for zero money.
Re: (Score:2)
We COULD have our own private CAs and have them be fully trusted if browser vendors would get off their collective butts and implement DNSSEC DANE TLSA (RFC6698). TLSA certificate usage mode 3 is the solution to browser-based certificate trust stores. Mode 3 lets anyone publish their own self-signed root cert (CA) to DNS and the browser would only trust certificates issued by that root CA for the domain in question. It solves all forms of MITM, cuts out third-party "trust" roots, works for internal netwo
Everywhere (Score:3)
But, I have to wonder: how would this functionality differ from the HTTPS Everywhere [google.com] extension developed by the Electronic Frontier Foundation and Tor?
Re: (Score:2)
https isn't necessary for a lot of things. I like the internet connected temp/humidity sensors that use http we have at work. No need to replace them, no need to have https. The browser people need to stop being goody-goodies ramming crap down our throat we don't need and don't want. If I want to use http for something they can keep their nose out of it.
Re: (Score:3)
I like the internet connected temp/humidity sensors that use http we have at work.
Otherwise known as sensor traffic which can be intercepted to identify temperature changes which may indicate if a building is empty and therefore a suitable target? That's your temperature sensor. What if someone else is using the same sensor in a more critical application?
The thing is *you* can only decide if HTTPS isn't necessary for *you* and *you alone*. You can't decide if someone else is being persecuted for the content which you or someone else provide them. You can't decide if they are being monit
Re: (Score:2)
No dumbass, sensors in a data center that won't reveal jack shit about any humans there, just if the Liebert is acting up again.
Your stupid hollywood scenario has never happened, won't happen. We shouldn't make defaults based on your neurotic runaway imagination. You show why I'm right and anyone opposed has only stupid fantasies about a one in a billion chance of something going wrong.
Moron.
Re: (Score:2)
I think we are all truly glad you don't work in security.
Call other people names all you want. Whether someone is a dumbass or a moron is based on what they said, and your post isn't driving the message you think it is.
Re: (Score:2)
to further expound on your stupidity, even though I have one cage in there and my $100 ethernet temp/humidity sensor which only ever shows building conditions since 150 W human means nothing and can't be detected with tens of kilowatts of heat dissipating gear on the floor, is in a building that has zero people except front desk 99.9999 percent the time. Assuming anyone even could get my private network to snoop the traffic, why would they bother when anyone could hit the sensor directly with their browser
Working on? (Score:3)
Seriously? Shouldn't it be swapping two lines of code to change the order in which it tries out a URL. FFS, developers these days.
LAN Access (Score:2)
Re: (Score:2)
Mozilla needs to allow whitelisting or some other way to disable HTTPS on local servers
Host it on port 80 and access it with 'http://'
You're welcome.
Re: (Score:2)
Mozilla needs to allow whitelisting or some other way to disable HTTPS on local servers
Host it on port 80 and access it with 'http://'
That only works if you have just one server per machine. My media sever, file server and Webmin are all on a single machine each with their own web interface needing a separate port.
You're welcome.
Oh, your one of those smug ass types who feel good about themselves when they think they've solved the problem.
Re: (Score:2)
That only works if you have just one server per machine. My media sever, file server and Webmin are all on a single machine each with their own web interface needing a separate port.
ok, host them on different ports and access them using 'http://*:port_num'
In the past, I've created my own root certificate and installed it in all my browsers. Here's a tutorial for how to do it [mozilla.org]. That will work if you aren't anti-https in particular, and just want to avoid your browser giving you warnings.
Re: (Score:2)
That only works if you have just one server per machine. My media sever, file server and Webmin are all on a single machine each with their own web interface needing a separate port.
ok, host them on different ports and access them using 'http://*:port_num'
Thank you for telling me how to do something I obviously know how to do and have been doing for years.
In the past, I've created my own root certificate and installed it in all my browsers. Here's a tutorial for how to do it [mozilla.org]. That will work if you aren't anti-https in particular, and just want to avoid your browser giving you warnings.
I'm not anti-https, I'm just anti-having to do something that shouldn't have to be done in the first place. While I'm perfectly capable of setting my own certificate, setting the servers to utilize it if possible (my printer has no way to set up to use HTTPS on it's web interface) takes time that I'd rather not give it. Every Raspberry Pi, Arduino or other do dad I connect would have to be set up for HTTP
Re: (Score:2)
Every Raspberry Pi, Arduino or other do dad I connect would have to be set up for HTTPS which is a pain in the ass if it can even be done in the first place.
I have no idea what you are trying to say here. That might be the core of the confusion.
Re: (Score:2)
Well, you can make your own CA and sign their certificates.
If there exists a device that's http-only, then at least it's possible to make a reverse proxy to add https to it, with a certificate of your choosing.
Of course, one could imagine a new protocol identifier, say, 'httpsi://192.168.1.2/", that cannot be accessed through href links and must be IP address, not name resolution, it must be typed manually into the address bar, and then it just makes the location bar blatantly obvious about it not being 'se
Re: (Score:2)
Well, you can make your own CA and sign their certificates.
If there exists a device that's http-only, then at least it's possible to make a reverse proxy to add https to it, with a certificate of your choosing.
And why not just make a method to access local networks without security? Creating your own CA and signing certificates for a local web service is a bit beyond most home users abilities, and while not a big pain to do for those of us who can, it's still more work than clicking a box that says to remember this unsecured server or even the whole domain from now on.
Of course, one could imagine a new protocol identifier, say, 'httpsi://192.168.1.2/", that cannot be accessed through href links and must be IP address, not name resolution, it must be typed manually into the address bar, and then it just makes the location bar blatantly obvious about it not being 'secure', but not nagging you about the certificate when coming in cold (e.g like ssh known_hosts, with less prompting).
One could similarly imagine 'httpi://' for internal devices that don't do tls, but still want to access locally, if you see fit.
One should not have to imagine things that do not exist to be able to navigate one's local network without jumping through bells and whistles
Re: (Score:2)
As someone no where near a browser or ietf group, all I can do is randomly suggest a scheme and hope that someone that actually matters would come along and consider if something like httpi/httpsi url scheme is attractive for the internal network problem.
Currently, the problem is to cater to internal networking means weakening internet scale access. It would be nice to facilitate internal networks in an entirely distinct way, naturally catering to the things such devices and networks are naturally used/not
DANE/TLSA support (Score:2)
I wish Google would put DANE (TLSA record) support back in Chrome. The one problem with HTTPS is that while it prevents third-party eavesdropping on communications, it does nothing to prevent attacks that hijack the endpoint itself. If someone can target DNS and change where a domain resolves, as long as their server's supplying a certificate issued by one of the huge number of CAs out there and has an alt name consistent with the domain the browser will blithely accept the hostile server as legitimate. All
Re: (Score:2)
Modern domain validated CA certificates depend on DNS, and DNS is the key to fixing the overly trusting CA stores, so DNS security is a requirement anyway. This makes DANE with DNSSEC the natural replacement for the now unnecessarily complex CA system.
It isn't that way already? (Score:2)
I thought it did already try forcing https to all sites. If it couldn't, it had several layers of tiny-font scare buttons to click through to get to the http plain site.
What are they doing, removing the button and saying "Tough luck!"
Re: (Score:2)