News for hackers. Stuff that matters.

A comment on Chrome 68 will mark all HTTP sites as “not secure”. Parent comment

Re:Chrome 68 will mark all HTTP sites as “not secure” by Cyphase on Thursday February 08, 2018 @11:28PM (#16337885)
> The existence of vulnerabilities doesn’t negate the bullshit security theatre of certificate authorities.

I agree that the current CA system has flaws, but there are efforts such as Certificate Transparency[1] and DANE[2] attempting to improve or bypass the CA system. That said, just having encryption defeats passive eavesdropping, and even the current CA system of authentication raises the bar for active eavesdropping.

> Banning http is a great example of tossing the baby with the bathwater.

I'm not sure what you mean by that.

> Https is better, but there are still valuable use cases for unencrypted web traffic.

Like what?

[1] https://en.wikipedia.org/wiki/Certificate_Transparency

[2] https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Na...

[ Parent | on HN ]
Re:Chrome 68 will mark all HTTP sites as “not secure” by dozzie on Friday February 09, 2018 @05:45AM (#16339282)
>> Https is better, but there are still valuable use cases for unencrypted web traffic.

> Like what?

Things like this: https://utcc.utoronto.ca/~cks/space/blog/tech/BIOSViaHTTPSen...

[ Parent | on HN ]
Re:Chrome 68 will mark all HTTP sites as “not secure” by Cyphase on Friday February 09, 2018 @01:42PM (#16342764)
Let's take it as given that HTTP is the right answer in that situation; I'm not saying it is or isn't, but let's assume it is. We're talking about HTTP(S) in web browsers and client-side applications; no one is actually talking about _banning_ HTTP, e.g. blocking port 80 or filtering via deep packet inspection. If you have a use case where after careful thought you decide that HTTP is better than HTTPS, then fine. But HTTPS should be the default.
[ Parent | on HN ]
Re:Chrome 68 will mark all HTTP sites as “not secure” by droopybuns on Friday February 09, 2018 @10:49PM (#16345765)
The functional result for the chrome browser’s ui warnings will be almost indistinguishable from banning http.
[ Parent | on HN ]
Re:Chrome 68 will mark all HTTP sites as “not secure” by Cyphase on Tuesday February 13, 2018 @03:45AM (#16365660)
For web sites and web browsers, sure. But if you want to use HTTP for your BIOS updates (dozzie's example), then go ahead; I don't think anyone is seriously proposing to stop you. Just please make sure that it's done securely. Anyway, TLS is not enough for secure updates.
[ Parent | on HN ]