Re:Chrome 68 will mark all HTTP sites as “not secure”
by dcow on Friday February 09, 2018 @11:59PM
(#16345968)
In IPv6 it does know. This is because IPv6 addresses have scoped prefixes. So much of this discussion is hinged on old IPv4 assumptions.
Re:Chrome 68 will mark all HTTP sites as “not secure”
by collinmanderson on Saturday February 10, 2018 @09:56PM
(#16350931)
So how does your browser know that a certain range of ip addresses should be trusted?
Exactly, that's why browsers are trying to move in the direction of making HTTP sites appear as less secure.
> I guess what I'm complaining about mostly boils down to an UX issue. It would be near-trivial for browser vendors to add the following to the error page if they detect a self-signed cert on a local connection: "This site seems to be served from the local network. If you are trying to access your own network infrastructure, please make sure the following fingerprint matches the one displayed by the application you are trying to access <fingerprint>, <autogenerated fingerprint art>. If you are unsure, please click 'Cancel'.".
I totally agree it's a UX issue, but I don't see a good solution. Unfortunately your browser doesn't know if you're on "your own network infrastructure" and not at a coffee shop. It needs to be on the safe side and assume it's not a trusted network.
Maybe the browser should require you to type in the fingerprint of the key.