Re:Chrome’s address bar will use https:// by default
by zaarn on Tuesday March 23, 2021 @06:40PM
(#26561243)
You can simply send a ICMP Rejected Message, which should direct your browser to immediately try any fallbacks or other hosts.
Timeouts occur when you incorrectly configure your firewall to drop packets instead of rejecting.
Re:Chrome’s address bar will use https:// by default
by xg15 on Tuesday March 23, 2021 @08:26PM
(#26562077)
True, that would work as well. Though I believe it's recommended as a best practice to simply drop packets as not to help port scanners.
Re:Chrome’s address bar will use https:// by default
by zaarn on Wednesday March 24, 2021 @10:26AM
(#26567643)
I don't worry about port scanners. If your infrastructure becomes less secure because of a port scanner, it's not very well secured. Sending a REJECT is cheap, no DDoS opportunity and helps browsers and other apps fail over fast.
The recommended practise I've heard everywhere is that an ICMP REJECT provides no opportunities for an attacker they wouldn't have with 10 minutes extra time (modern port scanners can be set aggressive enough that REJECT or DROP doesn't matter if they have a known open port they can obtain an ACCEPT timeline from).
Re:Chrome’s address bar will use https:// by default
by xg15 on Wednesday March 24, 2021 @10:53AM
(#26567967)
Yeah, that absolutely makes sense - as I said, a site could also avoid the timeout by sending a TCP RST packet. My point was more that I believe not many sites are doing any of this as in the past, "best-practice" firewall configuration was to be as silent as possible.
Re:Chrome’s address bar will use https:// by default
by zaarn on Thursday March 25, 2021 @07:02AM
(#26578673)
Being as silent as possible has only two effects; an attacker takes 2 seconds longer and you significantly degrade the network experience of all your users. It hasn't been best-practise in a while (outside the greybeard firewall admin circles), ie, almost a decade at this point. Anyone who hasn't figured that out should really consider not doing network admin if their knowledge is a decade out of date.
Re:Chrome’s address bar will use https:// by default
by xg15 on Thursday March 25, 2021 @09:09AM
(#26579763)
Hmm, OK. Might be that my knowledge was not really up-to-date there. I'd really appreciate if network protocols designed for common benefit (such as ICMP) are not discouraged due to security for a change. In this case, sorry for spreading FUD, that wasn't my intention.
More than a bit. For HTTPS-only sites, the site could serve a stub HTTP endpoint on port 80 that redirects to HTTPS. The redirect causes maybe some milliseconds to a few seconds (worst case) of latency.
HTTP-only on the other hand can't do a HTTPS stub as easily (as the primary reason you'd want HTTP-only is probably that you don't want/can't deal with the certificate management - if you can set up a redirect from HTTPS to HTTP, you might as well go full HTTPS)
So the only option for HTTP-only is to not open port 443 at all - meaning Chrome has to wait out the 30 seconds (!) network timeout until it can try the fallback. So pure-HTTP sites would become a lot more unpleasant to use.
(A site might be able to cut this short by actively refusing the TCP handshake and sending an RST packet - or by opening and immediately closing the connection. I don't know how Chrome would react to this. In any case, that's likely not what HTTP-only sites in the wild are doing, so they'll need to update their software - at which point, they might just as well spend the effort to switch to HTTPS)