Forums:

chrome marking http as insecure starting july

author & internet detective

Posts: 41911

909

posted 6 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

Chrome is marking http (vs https) as insecure starting July. I hope this doesn't scare non-technical users too much!
Source

[OCP 17 book] | [OCP 11 book] | [OCA 8 book] [OCP 8 book] [Practice tests book] [Blog] [JavaRanch FAQ] [How To Ask Questions] [Book Promos]
Other Certs: SCEA Part 1, Part 2 & 3, Core Spring 3, TOGAF part 1 and part 2

Stephan van Hulst

Saloon Keeper

Posts: 15620

366

posted 6 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

It should scare non-technical users, and that's exactly the point. It will force websites that wish their users not to be scared to make their site HTTPS only.

Bear Bibeault

Sheriff

Posts: 67748

173

I like...

posted 6 years ago

3
Number of slices to send:

Optional 'thank-you' note:

Send

My (haven't-really-read-much-about-it) opinion is that it seems a bit heavy-handed. Why should sites that handle no sensitive information be forced to put up with expense and bother of certificates?

[Asking smart questions] [About Bear] [Books by Bear]

Stephan van Hulst

Saloon Keeper

Posts: 15620

366

posted 6 years ago

1
Number of slices to send:

Optional 'thank-you' note:

Send

They shouldn't. But they're not secure. Men in the middle can still serve content that's different from what the server intended to serve. If the end-user is fine with that, they can ignore the "Not secure" label.

Stephan van Hulst

Saloon Keeper

Posts: 15620

366

posted 6 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

Also note that even if the original web page doesn't deal with sensitive information, the man in the middle can inject a page that seemingly does.

Stephan van Hulst

Saloon Keeper

Posts: 15620

366

posted 6 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

As an example, say I have created a website with the goal of informing people about the health risks of some kind of substance, and nothing more. A man in the middle can intercept the request and add a link to a page the spoofs the user's healthcare provider's page, containing a login section that's intended to capture passwords and stuff.

Bear Bibeault

Sheriff

Posts: 67748

173

I like...

posted 6 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

Good point, but it's not something most of my clients with just "meet and greet" pages would worry too much about (and want to shell out $$$ for).

If Google wants to "foster" this on the web, they should be doing something to make certificates less expensive, and a lot less hassle to deal with.

[Asking smart questions] [About Bear] [Books by Bear]

Pete Letkeman

Bartender

Posts: 1868

I like...

posted 6 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

I'm not too sure that the cost is that much.
You can get a certificate from RapidSSL, a division of GeoTrust, which itself is a division of Symantec,
for $60 USD a year as seen here https://www.rapidssl.com/buy-ssl/ssl-certificate/.
This should make the "meet and greet" sites secure enough for Chrome not to complain.
At $60 a year is only $5 a month, and many people spend at least that on non essentials each month.
That said using HTTPS does require more from the server hardware and someone does need to install the certificate.

“The strongest of all warriors are these two — Time and Patience.” ― Leo Tolstoy, War and Peace

Tim Moores

Saloon Keeper

Posts: 7597

177

posted 6 years ago

1
Number of slices to send:

Optional 'thank-you' note:

Send

I thought Let's Encrypt essentially makes the cost of certificates go away (for non-commercial). Not so?

Pete Letkeman

Bartender

Posts: 1868

I like...

posted 6 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

Tim Moores wrote:I thought Let's Encrypt essentially makes the cost of certificates go away (for non-commercial). Not so?

Interesting, I did not know about Let's Encrypt before this.

Looks like anyone can use Let's Encrypt

Let's Encrypt Community wrote:Commercial users are welcome to use Let’s Encrypt for commercial and for-profit purposes.
This is an intended use; we don’t have any desire to restrict the use of our services to non-profit or non-commercial purposes.

https://community.letsencrypt.org/t/are-they-limitations-on-who-can-use-lets-encrypt/687/2

I do see one drawback to it, which is that each certificate is only good for 90 days as noted here https://letsencrypt.org/2015/11/09/why-90-days.html.
There is a path for most major servers to automatically renew the Let's Encrypt certificate, simply Google "letsencrypt auto renew yourWebServer" to find guides/info.

“The strongest of all warriors are these two — Time and Patience.” ― Leo Tolstoy, War and Peace

Norm Radder

Rancher

Posts: 5008

posted 6 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

Another input:

Chrome’s Plan to Distrust Symantec Certificates

https://security.googleblog.com/2017/09/chromes-plan-to-distrust-symantec.html

Jeanne Boyarsky

author & internet detective

Posts: 41911

909

I like...

posted 6 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

Isn't $5 a month a lot in some countries?

Don't get me started about those stupid light bulbs.