Chrome Security Team Proposes Marking HTTP Sites As 'Non-Secure'
The Chrome browser is generally considered the most secure Web browser, and it also tends to do the best in hacking competitions such as Pwn2Own. This is in part thanks to the solid security architecture of Chrome, and to its security engineers, who keep adopting strong security designs and policies.
There's always a compromise between security and flexibility/freedom to do something. Security is very much about reducing the attack vectors, which generally means reducing the freedom to use some features.
Some of those security decisions can go too far sometimes, such as the decision to only allow Chrome extensions to be installed from the Chrome store, when there could have been alternative solutions that are not as restrictive.
On Android, users are still allowed to sideload applications, just like Windows and Mac OS users can still install applications from outside the main store. This feature remains despite Android having a much bigger market share than Chrome, and with sideloaded Android apps being potentially much more damaging than Chrome extensions. Yet the security people in charge of Android have decided it's a necessary freedom that needs to stay within the Android ecosystem.
The Chrome Security Team has recently made a proposal on the Chromium.org site that is bound to make some web developers unhappy but at the same time could be highly beneficial to the Web if implemented properly. The team proposed that all browsers begin marking HTTP (plain-text traffic) websites as "non-secure" beginning next year. This comes after Google already announced this year that HTTPS sites would be getting a slight boost in its search engine.
The new move could immediately make some developers panic. However, the security team proposed that this transition happen gradually in order to give developers time to encrypt their websites with HTTPS, if they have not done it already.
The Chrome team said there are three main states for web properties:
Get Tom's Hardware's best news and in-depth reviews, straight to your inbox.
Secure [valid HTTPS, other origins like (*, localhost, *)];Dubious (valid HTTPS but with mixed passive resources, valid HTTPS with minor TLS errors); andNon-secure (broken HTTPS, HTTP).
After the Snowden revelations, we know that HTTP is indeed non-secure, and spy agencies from all over the world can not only intercept and spy on that HTTP traffic, but they can also send malware through it.
Chrome's security engineers proposed that browser vendors make the following four-phase transition:
T0 (now): Non-secure origins unmarkedT1: Non-secure origins marked as DubiousT2: Non-secure origins marked as Non-secureT3: Secure origins unmarked
The goal seems to be that ultimately, most (over 85 percent) sites would be protected with HTTPS, and then they wouldn't need to keep the current green mark that differentiates them from the unprotected HTTP sites. The status quo would be encrypted traffic, and only a small percentage would remain marked as non-secure.
The Chrome team intends to implement its transition plan for declaring HTTP sites "non-secure" next year.
Follow us @tomshardware, on Facebook and on Google+.
Lucian Armasu is a Contributing Writer for Tom's Hardware US. He covers software news and the issues surrounding privacy and security.
-
ralanahm this page is non-Reply
http://www.tomshardware.com/news/chrome-security-http-non-secure,28223.html -
spdragoo The problem is that you only need an "https" site if you're going to be logging into it: online banking, online billpay, email, social networks, etc.Reply
If all you're doing is visiting a site to read articles or reference information, then you don't need a "secure" website, because you're not logging into an account that needs to be secured. -
dennisfyfe ReplyThe problem is that you only need an "https" site if you're going to be logging into it: online banking, online billpay, email, social networks, etc.
If all you're doing is visiting a site to read articles or reference information, then you don't need a "secure" website, because you're not logging into an account that needs to be secured.
Might help to read the ENTIRE article.
"After the Snowden revelations, we know that HTTP is indeed non-secure, and spy agencies from all over the world can not only intercept and spy on that HTTP traffic, but they can also send malware through it." -
dthx Reply
It is equally easy to send malware through an https website than through an http website. In fact, in many cases, it even further increases your chances of getting the malware delivered to the right computer as the encryption makes it impossible for some firewalls to analyze the traffic (SSL interception is possible on decent firewalls but often not configured in many companies).The problem is that you only need an "https" site if you're going to be logging into it: online banking, online billpay, email, social networks, etc.
If all you're doing is visiting a site to read articles or reference information, then you don't need a "secure" website, because you're not logging into an account that needs to be secured.
Might help to read the ENTIRE article.
"After the Snowden revelations, we know that HTTP is indeed non-secure, and spy agencies from all over the world can not only intercept and spy on that HTTP traffic, but they can also send malware through it."
I understand that SSL makes spoofing more difficult, but don't tell me that government agencies have no possibility to obtain the certificates they need for their mission ;-) -
Wait what? Is there any reason why a read-only portfolio site for example, needs HTTPS?Reply
As someone said above, best get handing out those certificate's Google, that stuff's expensive. -
gmuser Speaking of HTTPS, does Tomshardware work on https?Reply
https://www.tomshardware.com seems not to work for me. -
mradamdavies This is retarded. I really don't like the direction in which Chrome is moving. The following statement makes no sense at all... "we know that HTTP is indeed non-secure" Kind of a non sequitur. HTTPS doesn't ensure security but is one aspect thereof. They should focus on marking compromised sites and not targeting those that can't afford to, or prohibited by technical limitations.Reply
Should my comment have been Tom's Hardware isn't HTTPS?!?!?!?!?1one... OMG, I got haxored!"