Re:Chrome 68 will mark all HTTP sites as “not secure”
by yzmtf2008 on Thursday February 08, 2018 @11:38PM
(#16337927)
It's not just javascript though, we've seen ISP (or other malicious actors in the network) inject ads, of even place the entire HTML content of the site into an iframe.
Re:Chrome 68 will mark all HTTP sites as “not secure”
by r00fus on Thursday February 08, 2018 @11:51PM
(#16337962)
Bingo. This is why it matters to Google. Ad injection could impact their bottom line.
Re:Chrome 68 will mark all HTTP sites as “not secure”
by innagadadavida on Friday February 09, 2018 @01:01AM
(#16338227)
This is a malware injection problem and it should be possible for google to create signatures of JavaScript from different websites and have chrome verify it and block it.
Penalizing all http users is heavy handed and google should not go down that path.
The most straightforward thing to do would be to disable javascript on non https sites by default or warn if a nonhttps site has javascript. Most of the old sites we want to keep around don't have javascript in them (or much javascript in them).
Ideally people should only be enabling javascript on sites they trust (and are running https for "real" "trust") but having a trusted whitelist for enabling javascript brings back your big brother arguments.