Chrome 68 Released: HTTP Sites Marked as “Not Secure”

Re:Chrome 68 Released: HTTP Sites Marked as “Not Secure” by Dolores12 on Wednesday July 25, 2018 @04:43AM (#17607779)

All legacy content heritage that is hosted using http protocol just became not secure in Chrome. What solution does google suggest? Who will pay to upgrade old infrastructure? Pandora box.

[ Parent | on HN ]

Re:Chrome 68 Released: HTTP Sites Marked as “Not Secure” by ealhad on Wednesday July 25, 2018 @04:45AM (#17607790)

All legacy content that is hosted using http protocol is, in fact, not secure. It's definitely not a bad thing to warn people.

[ Parent | on HN ]

Re:Chrome 68 Released: HTTP Sites Marked as “Not Secure” by Dolores12 on Wednesday July 25, 2018 @05:48AM (#17608054)

For general public 'not secure' imply something like 'not safe'.

[ Parent | on HN ]

Re:Chrome 68 Released: HTTP Sites Marked as “Not Secure” by beezle on Wednesday July 25, 2018 @09:45AM (#17609158)

That is exactly why Google's choice of wording is so poor. Far better would be 'encrypted/not encrypted' as that is all https really is. Safe can have far to many meanings and I won't be at all surprised when Google faces a class action when 'unsafe' things happen on a website they deem 'safe.'

Personally don't understand the heavy push to force https on everything and anything. The maintenance/time required to set up and maintain is not insignificant and is really quite pointless in many situations. Do you really need an encrypted connection to LOLCats?

[ Parent | on HN ]

Re:Chrome 68 Released: HTTP Sites Marked as “Not Secure” by ealhad on Wednesday July 25, 2018 @09:48AM (#17609173)

You need an encrypted connection, period.

If you only use an encrypted connection when you need it, then one can know that, well, you need it.

You have nothing to hide... until you do.

[ Parent | on HN ]

Re:Chrome 68 Released: HTTP Sites Marked as “Not Secure” by mynewaccount0 on Wednesday July 25, 2018 @06:27AM (#17608184)

Somebody better warn the Debian maintainers that their packages have been Not Secure for the past decade-or-more.

[ Parent | on HN ]

Re:Chrome 68 Released: HTTP Sites Marked as “Not Secure” by matthewmacleod on Wednesday July 25, 2018 @04:53AM (#17607822)

Yes, that's right – because it _is_ insecure, fundamentally.

These sites will continue to be entirely accessible, so I have no idea what solution you think is required. If a provider wants to upgrade such that their site is no longer insecure, then they can pay to upgrade it themselves.

[ Parent | on HN ]

Re:Chrome 68 Released: HTTP Sites Marked as “Not Secure” by mynewaccount0 on Wednesday July 25, 2018 @06:32AM (#17608209)

This is absolutely, entirely wrong. It's so wrong that I need to wonder why you don't even realize you're wrong. A HTTP website with my GPG-signed data is _more_ secure than an HTTPS website. Relying on a CA is not the only way to secure a website. But this isn't about securing websites, this is about forcing us to rely on CAs.

[ Parent | on HN ]

Re:Chrome 68 Released: HTTP Sites Marked as “Not Secure” by realusername on Wednesday July 25, 2018 @05:07AM (#17607866)

You can still browse it, it's just written non-secure because it's actually not secure.

[ Parent | on HN ]

Re:Chrome 68 Released: HTTP Sites Marked as “Not Secure” by ahje on Wednesday July 25, 2018 @05:33AM (#17607987)

I recommend you have a look at this one: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Co...

[ Parent | on HN ]

Re:Chrome 68 Released: HTTP Sites Marked as “Not Secure” by Dolores12 on Wednesday July 25, 2018 @05:50AM (#17608062)

That is exactly what i am talking about. Who will pay to update legacy website content to include meta tag or update webserver config to include http header?

[ Parent | on HN ]

Re:Chrome 68 Released: HTTP Sites Marked as “Not Secure” by RandomInteger4 on Wednesday July 25, 2018 @04:55AM (#17607833)

Presumably the businesses that should have seen this coming a long time ago.

[ Parent | on HN ]