Re:Chrome 68 will mark all HTTP sites as “not secure”
by Cyphase on Friday February 09, 2018 @01:42PM
(#16342764)
Let's take it as given that HTTP is the right answer in that situation; I'm not saying it is or isn't, but let's assume it is. We're talking about HTTP(S) in web browsers and client-side applications; no one is actually talking about _banning_ HTTP, e.g. blocking port 80 or filtering via deep packet inspection. If you have a use case where after careful thought you decide that HTTP is better than HTTPS, then fine. But HTTPS should be the default.
Re:Chrome 68 will mark all HTTP sites as “not secure”
by droopybuns on Friday February 09, 2018 @10:49PM
(#16345765)
The functional result for the chrome browser’s ui warnings will be almost indistinguishable from banning http.
Re:Chrome 68 will mark all HTTP sites as “not secure”
by Cyphase on Tuesday February 13, 2018 @03:45AM
(#16365660)
For web sites and web browsers, sure. But if you want to use HTTP for your BIOS updates (dozzie's example), then go ahead; I don't think anyone is seriously proposing to stop you. Just please make sure that it's done securely. Anyway, TLS is not enough for secure updates.
> Like what?
Things like this: https://utcc.utoronto.ca/~cks/space/blog/tech/BIOSViaHTTPSen...