News for hackers. Stuff that matters.

A comment on Chrome 68 will mark all HTTP sites as “not secure”. Parent comment

Re:Chrome 68 will mark all HTTP sites as “not secure” by tbrock on Friday February 09, 2018 @11:27AM (#16341485)
Certainly there could be an exception for localhost right?
[ Parent | on HN ]
Re:Chrome 68 will mark all HTTP sites as “not secure” by aurelian15 on Friday February 09, 2018 @02:31PM (#16343151)
Yes, there already is an exception for localhost. HTTP on localhost is considered a "secure context".

Edit: To be more precise, and to quote [1]

"Secure Contexts says UAs MAY treat localhost as a secure context only if they can guarantee it will only ever resolve to a loopback address (and are in any case not required to). https://w3c.github.io/webappsec-secure-contexts/#localhost"

[1] https://github.com/w3ctag/design-principles/pull/75#issuecom...

[ Parent | on HN ]
Re:Chrome 68 will mark all HTTP sites as “not secure” by collinmanderson on Friday February 09, 2018 @11:55AM (#16341767)
I'm curious about this myself. Would there be an attack vector?

It seems to me secure localhost would only be needed for developers, and developers should be able to allow a self-signed cert.

[ Parent | on HN ]