Hacker News Reader

Comment by redcastle | Hacker News Reader

Google Chrome is supposed to soon start flashing a "not secure" warning on HTTP sites that have password forms [0]. That's probably at least one motivation for these publisher moves to HTTPS

[0] https://security.googleblog.com/2016/09/moving-towards-more-...

View on HN

Firefox 51 is slated to have this as well.

https://bugzilla.mozilla.org/show_bug.cgi?id=1319119

What happens with local LAN machines, like the admin webpage for your wireless access point? It's not like they can go HTTPS?

if those pages are not secure, then they will display "not secure" in the address bar.

They're not trying to force everything over to https, they're just trying to make warnings more sane. And if a page is not secure, marking it as such makes sense.

https://security.googleblog.com/2016/09/moving-towards-more-...

There's gonna be a small "not secure" label next to the URL (like there's now the "secure" label on HTTPS websites in Chrome/Chromium). It's not like you're not going to be able to open the webpage or anything.

This is an issue we're encountering. One solution is trust on first use of a self signed cert, which makes the scary untrusted page a one time cost. This isn't terribly easy in the browser though. With more IOT devices entering the market, this could become a more common issue.

Using https for a local network connection will also be more common, in the case you decide you don't trust the network.

I think for the case of the home router admin page (or really any admin page on your local network), the browser can easily detect that it's being served a page on the local net, and could provide a less scary warning that has some text that acknowledges that you're on your local net and that either ignoring the password form security warning (for http) or accepting the self-signed cert (for https) is probably ok. Whether they'll do this is another question...

It absolutely makes sense not to display warnings that HTTPS isn't in use in circumstances where HTTPS is not feasible - i.e. local addresses. It's simple enough for a browser to determine. I don't think conditionally accepting a self-signed cert is necessary.

I could have sworn firefox already did this, or maybe that ws just elinks...

In current stable Firefox, you have to manually enable `security.insecure_password.ui.enabled` for that.

The change is to set it on by default.

Reply on news.ycombinator.com