News for hackers. Stuff that matters.
Re:Chrome 56 will mark HTTP pages with password fields as no... by oh_sigh on Sunday January 22, 2017 @04:43PM (#13457712)
Why do you have a password field on a http site?
Re:Chrome 56 will mark HTTP pages with password fields as no... by johndoe4589 on Sunday January 22, 2017 @05:06PM (#13457863)
Like every other person who started a forum some years ago or a wordpress blog you mean?

Do you think web hosts offer SSL by default?

NO they don't. Duh. That's what is annoying in these comments. Everyone seems to shrug like SSL is standard feature nowadays, except is isn't.

Re:Chrome 56 will mark HTTP pages with password fields as no... by lucideer on Sunday January 22, 2017 @05:16PM (#13457938)
That's the point. SSL/TLS is a standard feature nowadays. If you're a web host and you don't support certs or charge some unreasonable fee for adding them (and I'm well aware there are far too many of these out there), then you need to be losing business fast. Your customers should be moving to better competitors. This measure just accelerates this process.
Re:Chrome 56 will mark HTTP pages with password fields as no... by johndoe4589 on Monday January 23, 2017 @09:31AM (#13462350)
True, it's just the transition atm is a bit painful.

My host is asking ~80 USD for multi domain SSL. It's not that bad, but they don't support Let's Encrypt yet afaik. Are they aware of this and trying to cash in on people who don't want the hassle of moving their sites?

On the other hand, if I buy there is none of that "auto renew" business...

Re:Chrome 56 will mark HTTP pages with password fields as no... by mikeash on Sunday January 22, 2017 @05:47PM (#13458104)
You're leaving your users vulnerable because you can't be bothered to do things correctly. You are not the wronged party here, they are, and you're just finally being pushed into doing it right.
Re:Chrome 56 will mark HTTP pages with password fields as no... by geofft on Sunday January 22, 2017 @09:46PM (#13459317)
Any web host that doesn't offer SSL by default, for free, is offering an inferior product. I worked on my university's web host from 2006-11 and we put a lot of work into making sure people could use HTTPS whenever they wanted, despite technical limitations (mod_vhost_ldap and SNI don't play well together), and that was a volunteer project, well before the current era of free certs.

If this change convinces people not to use commercial web hosts that don't offer SSL, it will have done a good thing for the web.

Re:Chrome 56 will mark HTTP pages with password fields as no... by Operyl on Sunday January 22, 2017 @05:37PM (#13458045)
Err, I work for a web host and we offer SSL by default as part of the onboarding. Speak for yourself :).