News for hackers. Stuff that matters.

A comment on HTTPS on NYTimes.com. Parent comment

Re:HTTPS on NYTimes.com by redcastle on Tuesday January 10, 2017 @04:21PM (#13369118)
Google Chrome is supposed to soon start flashing a "not secure" warning on HTTP sites that have password forms [0]. That's probably at least one motivation for these publisher moves to HTTPS

[0] https://security.googleblog.com/2016/09/moving-towards-more-...

[ Parent | on HN ]
Re:HTTPS on NYTimes.com by yukinon on Tuesday January 10, 2017 @04:35PM (#13369274)
Firefox 51 is slated to have this as well.

https://bugzilla.mozilla.org/show_bug.cgi?id=1319119

[ Parent | on HN ]
Re:HTTPS on NYTimes.com by mparlane on Tuesday January 10, 2017 @06:06PM (#13370106)
What happens with local LAN machines, like the admin webpage for your wireless access point? It's not like they can go HTTPS?
[ Parent | on HN ]
Re:HTTPS on NYTimes.com by notatoad on Tuesday January 10, 2017 @06:27PM (#13370267)
if those pages are not secure, then they will display "not secure" in the address bar.

They're not trying to force everything over to https, they're just trying to make warnings more sane. And if a page is not secure, marking it as such makes sense.

https://security.googleblog.com/2016/09/moving-towards-more-...

[ Parent | on HN ]
Re:HTTPS on NYTimes.com by hirsin on Tuesday January 10, 2017 @08:21PM (#13370969)
This is an issue we're encountering. One solution is trust on first use of a self signed cert, which makes the scary untrusted page a one time cost. This isn't terribly easy in the browser though. With more IOT devices entering the market, this could become a more common issue.

Using https for a local network connection will also be more common, in the case you decide you don't trust the network.

[ Parent | on HN ]
Re:HTTPS on NYTimes.com by kelnos on Wednesday January 11, 2017 @01:07AM (#13372099)
I think for the case of the home router admin page (or really any admin page on your local network), the browser can easily detect that it's being served a page on the local net, and could provide a less scary warning that has some text that acknowledges that you're on your local net and that either ignoring the password form security warning (for http) or accepting the self-signed cert (for https) is probably ok. Whether they'll do this is another question...
[ Parent | on HN ]
Re:HTTPS on NYTimes.com by Whitestrake on Wednesday January 11, 2017 @01:38AM (#13372210)
It absolutely makes sense not to display warnings that HTTPS isn't in use in circumstances where HTTPS is not feasible - i.e. local addresses. It's simple enough for a browser to determine. I don't think conditionally accepting a self-signed cert is necessary.
[ Parent | on HN ]
Re:HTTPS on NYTimes.com by r3bl on Tuesday January 10, 2017 @06:31PM (#13370292)
There's gonna be a small "not secure" label next to the URL (like there's now the "secure" label on HTTPS websites in Chrome/Chromium). It's not like you're not going to be able to open the webpage or anything.
[ Parent | on HN ]
Re:HTTPS on NYTimes.com by swiley on Tuesday January 10, 2017 @04:49PM (#13369433)
I could have sworn firefox already did this, or maybe that ws just elinks...
[ Parent | on HN ]
Re:HTTPS on NYTimes.com by nine_k on Tuesday January 10, 2017 @05:09PM (#13369627)
In current stable Firefox, you have to manually enable `security.insecure_password.ui.enabled` for that.

The change is to set it on by default.

[ Parent | on HN ]