News for hackers. Stuff that matters.

A comment on Chrome’s address bar will use https:// by default. Parent comment

Re:Chrome’s address bar will use https:// by default by shadowgovt on Tuesday March 23, 2021 @04:22PM (#26559944)
Unfortunately, since one is breaking the SSL trust model, that's probably the right solution. Not unlike having to explicitly enable "Developer mode" before a whole host of security-breaking options are available.

Actually, that's one solution Apple could consider: if a user has enabled Developer Mode on a given iOS device, allow the trust model to be broken with an "Are you sure you know what you're doing?" button instead of a silent failure.

[ Parent | on HN ]
Re:Chrome’s address bar will use https:// by default by ericbarrett on Tuesday March 23, 2021 @06:30PM (#26561174)
Scammers: "You have to enable developer mode to see our new bank website because it's in development"
[ Parent | on HN ]
Re:Chrome’s address bar will use https:// by default by Wowfunhappy on Tuesday March 23, 2021 @07:12PM (#26561552)
At that point, isn’t it easier to send the user to chase.com.scammer.com?

The goal isn’t to make a 100% foolproof system (because you can’t), and needing to flip a switch called “developer mode”, which preferably also displays a warning message, should make it clear something is wrong.

...I think this whole discussion is kind of missing the point though. Developers are not the only people who need to log in to routers.

[ Parent | on HN ]