News for hackers. Stuff that matters.
Re:Chrome 56 will mark HTTP pages with password fields as no... by ocdtrekkie on Sunday January 22, 2017 @08:54PM (#13459068)
Passwords are NOT by definition sensitive, and this is the sort of absolutist nonsense that I'm complaining about. Passwords are only as sensitive as the data they access.
Re:Chrome 56 will mark HTTP pages with password fields as no... by stanleydrew on Sunday January 22, 2017 @09:08PM (#13459152)
This is false. Passwords are only as sensitive as all the data they access. Given that it's impossible for you to know what other data the user is protecting with the same password, you must assume all passwords are as sensitive as the most sensitive data a user might reasonably secure with that password.

Do I wish things were different, and that everyone on earth used unique passwords for every site? Of course. But I think you know that's never going to describe reality.

Re:Chrome 56 will mark HTTP pages with password fields as no... by ocdtrekkie on Sunday January 22, 2017 @10:10PM (#13459424)
As someone who runs like a roleplaying site for like ten people (or several of them), I cannot be responsible for other people's bank passwords, nor should I be punished for daring to host websites without the huge added burden of cost of HTTPS.

The notion that every homebrew website is supposed to support HTTPS is also never going to describe reality.

Re:Chrome 56 will mark HTTP pages with password fields as no... by Vendan on Monday January 23, 2017 @12:47AM (#13460096)
Then really, Google's done you a solid. Now everyone using your site will know it's not as secure as their bank, and therefore, when their creds for your sites are stolen, and they get their identity stolen as a result, you can just say "Hey, everything told you it wasn't secure, not my problem"...
Re:Chrome 56 will mark HTTP pages with password fields as no... by rimantas on Monday January 23, 2017 @08:46AM (#13462098)
You should not be responsible for running any of the sites with this attitude.
Re:Chrome 56 will mark HTTP pages with password fields as no... by ocdtrekkie on Monday January 23, 2017 @09:02AM (#13462186)
Again, this is not a productive or useful security attitude to take. We've made some grave privacy missteps with poor security advice time and time again, so simply saying "HTTPS is better and everyone should use it" is not inherently accurate. Especially when it's completely impractical with the tools available.