Chrome 68 will mark all HTTP sites as “not secure”

Re:Chrome 68 will mark all HTTP sites as “not secure” by kuschku on Friday February 09, 2018 @07:01AM (#16339552)

If you have E2E auth/encryption, all a malicious DHCP server can is, indirectly, identifying every site you connect to, and potentially blocking you from accessing some sites. Or all. It can intercept all unencrypted stuff. This includes NTP, which in turn means your computer’s clock will be set wrong, which in turn means it can give you long distrusted certificates whose private keys have leaked.

TL;DR: If you can MitM a system at the root, you can already break basically anything relevant.

[ Parent | on HN ]

Re:Chrome 68 will mark all HTTP sites as “not secure” by icebraining on Friday February 09, 2018 @07:26AM (#16339679)

Yes, they can block me, but that's just annoying, not insecure. Intercepting unencrypted stuff is the reason for this whole thread. And if they change my computer's date, they might get one malicious cert working - assuming they can change it enough, since NTP has mechanisms for avoiding large leaps - but they'll break every single HTTPS connection besides that one, which I'm sure the user would notice almost immediately.

Meanwhile, routers are generally known to be insecure, and who knows how many viruses my guests bring onto my Wifi network when they ask to connect.

[ Parent | on HN ]