Chrome 68 will mark all HTTP sites as “not secure”

Re:Chrome 68 will mark all HTTP sites as “not secure” by slobotron on Thursday February 08, 2018 @09:39PM (#16337496)

Those forms sit in an IFRAME and content is loaded via https. Example from http://seasportdivers.com/ :

[ Parent | on HN ]

Re:Chrome 68 will mark all HTTP sites as “not secure” by eropple on Thursday February 08, 2018 @10:01PM (#16337583)

That's not sufficient when the external page can be controlled and the iframe target set by it.

[ Parent | on HN ]

Re:Chrome 68 will mark all HTTP sites as “not secure” by slobotron on Thursday February 08, 2018 @11:22PM (#16337869)

Agreed that in situation like this it's near impossible to ascertain that iframe target wasn't altered, unless you already somehow know what it was before you got mitmd.

[ Parent | on HN ]

Re:Chrome 68 will mark all HTTP sites as “not secure” by fiddlerwoaroof on Thursday February 08, 2018 @10:02PM (#16337584)

Yeah, that’s a little better but can’t an attacker inject something in the surrounding the age that compromises the iframe? Or even rewrite the iframe to use a proxy under the attackers control?

[ Parent | on HN ]

Re:Chrome 68 will mark all HTTP sites as “not secure” by fishywang on Thursday February 08, 2018 @10:49PM (#16337769)

Maybe the vendor improved since then (it's still not very secure as others and Chrome pointed out), but I remembered that back last Aug I searched for "https" in the source code and that's not the case.

[ Parent | on HN ]

Re:Chrome 68 will mark all HTTP sites as “not secure” by slobotron on Thursday February 08, 2018 @11:25PM (#16337878)

Even now it doesn't inspire much confidence :)

[ Parent | on HN ]