Topic: Why does Chrome say https is insecure?
Anonymous A started this discussion 14 years ago #18,700
When every site I know says it's more secure?
Hmm...
Hmm...
batman joined in and replied with this 14 years ago, 1 minute later[^] [v] #309,444
derp
Stealth joined in and replied with this 14 years ago, 1 minute later, 2 minutes after the original post[^] [v] #309,445
Based on reports of baaaaaad shit. Virus/Maleware
Probably a one or two day event until the site owner gets the mess cleared. Be happy Google is warning you. Of course you could launch IE and get infected lol
Probably a one or two day event until the site owner gets the mess cleared. Be happy Google is warning you. Of course you could launch IE and get infected lol
Anonymous A (OP) replied with this 14 years ago, 3 minutes later, 5 minutes after the original post[^] [v] #309,450
Stealth replied with this 14 years ago, 11 minutes later, 17 minutes after the original post[^] [v] #309,453
@previous (A)
Chances are super high that Firefox will give you the same result. With Firefox the Icon in your bookmarks will end up changed to a Red symbol with an X through it. When site is all Go again the X will drop out but you will notice the Red remains.
You might discover with Chrome that if you have Ad Block installed as I do that the extension will prevent loading. You could disable Ad Block and try again. Me? I wood first hit the web for a look up of the site to see IF others are posting warnings.
Chances are super high that Firefox will give you the same result. With Firefox the Icon in your bookmarks will end up changed to a Red symbol with an X through it. When site is all Go again the X will drop out but you will notice the Red remains.
You might discover with Chrome that if you have Ad Block installed as I do that the extension will prevent loading. You could disable Ad Block and try again. Me? I wood first hit the web for a look up of the site to see IF others are posting warnings.
(Edited 6 minutes later.)
Anonymous D joined in and replied with this 14 years ago, 7 minutes later, 25 minutes after the original post[^] [v] #309,454
HTTPS isn't insecure but it might just be warning you that some elements on the page you are looking at are insecure. Screenshot please.
Lee O'Nidas !nBpim1wazU joined in and replied with this 14 years ago, 19 minutes later, 44 minutes after the original post[^] [v] #309,456
You oughta use the browser made by DuckDuckGo, not one made by Google (Chrome) or funded almost entirely by Google (Firefox).batman replied with this 14 years ago, 1 minute later, 46 minutes after the original post[^] [v] #309,458
Lee O'Nidas !nBpim1wazU replied with this 14 years ago, 1 minute later, 48 minutes after the original post[^] [v] #309,460
@previous (batman)Dogpile is a good google alternative also, but they don't make web browsers, they make dog slippers.
Stealth replied with this 14 years ago, 4 minutes later, 52 minutes after the original post[^] [v] #309,462
@309,458 (batman)
Not aware of this Peking Duck thingy so I hit web and C its a search engine including one called Bang lol bet Bing gets a laff out of such.
Me thinks Leonids gets a quack out of his suggestion
re name wiki says "When questioned about it, Weinberg (Duck dude gure explained, "[r]eally it just popped in my head one day and I just liked it. It is certainly influenced/derived from [the game] Duck Duck Goose, but other than that there is no relation, e.g. a metaphor
Not aware of this Peking Duck thingy so I hit web and C its a search engine including one called Bang lol bet Bing gets a laff out of such.
Me thinks Leonids gets a quack out of his suggestion
re name wiki says "When questioned about it, Weinberg (Duck dude gure explained, "[r]eally it just popped in my head one day and I just liked it. It is certainly influenced/derived from [the game] Duck Duck Goose, but other than that there is no relation, e.g. a metaphor
r04r !GETFUCKED joined in and replied with this 14 years ago, 25 minutes later, 1 hour after the original post[^] [v] #309,477
I suggest you read the error message. HTTPS is always more secure than plain HTTP, but some HTTPS websites do not have a properly signed certificate (which costs money to acquire), and your browser will warn you about this. The reason is, anyone can create a certificate like that. You have no way to know if it's the right one, and not someone else pretending to be the web server (so they can look at your traffic).
If the website is some chan site, or a community based thing that doesn't have much money to their disposal it's very likely that the HTTPS warnings are correct, but that you can ignore them. Or add it to a whitelist.
If the website is some chan site, or a community based thing that doesn't have much money to their disposal it's very likely that the HTTPS warnings are correct, but that you can ignore them. Or add it to a whitelist.
HaikerensGuide !0VegJ9Jl.Q joined in and replied with this 14 years ago, 4 minutes later, 1 hour after the original post[^] [v] #309,478
The CA system is a joke.
Once upon a time, in the early-to-mid 1990s, the World-Wide Web was born and started attracting users. Right from the start (or at least more or less; we're talking 1994), the rather obvious decision (at the time) was made to have two separate protocols/schemas: "HTTP" and "HTTPS".
HTTP (HyperText Transfer Protocol), which is still the dominant one in the year of 2012, is quick, simple and entirely unencrypted. Any password or other information sent in either direction is sent in plain text and can be trivially "sniffed" by anyone at any point in the network between your computer and the destination.
HTTPS (HyperText Transfer Protocol Secure), which has traditionally primarily been used for e-commerce and online bank interfaces, is much more "expensive" to compute (AKA slower) but uses TLS (previously SSL) as an "encryption wrapper" around HTTP. HTTPS is HTTP with encryption. In later years, it has become far more common for perceivably "non-critical" sites such as Wikipedia or Google Search to offer such an interface, and many sites use it only for the login form to save resources while still giving their users some protection.
Note: "TLS" is the successor to "SSL". SSL is still a very common term, but technically wrong when one is referring to TLS, which you more or less always are. Of course, that doesn't stop people from confusing them and capitalizing on the established but now incorrect term.
While this doesn't exactly have anything to do with Web sites specifically, since TLS/SSL can and are used for many other tasks, this "Certificate Authority" system is built around the idea of "ultimately trusted and authoritative parties" which are shipped with every browser on every computer.
The technical details of setting up a TLS certificate are messy and off-topic here, and also vary between Web servers and systems, but what you need to know is this: somebody must "sign" it. In practice, this means one of these huge, "trusted" companies, or yourself. Yeah, that's right. You can "self-sign" your certificates, and this would be good enough, except for the little, minor issue that if you do, every single visitor to your Web site is going to get big, flashing, red warnings urging you to not trust this horribly insecure and untrusted site which is all broken and stuff.
I'm not kidding. All modern browsers try their very best to make you close the tab entirely and surf elsewhere. Even when you know as much as I do about this, it's still scary to see it. It really makes you question the site, even though there is no technical reason to. Let me explain…
For this reason, since browser authors have all ganged up behind the CA Mafia, you have to either use HTTP (unthinkable in many cases) or forget about self-signing and pay one of the companies. If they will even let you. I'll get back to that.
Apparently, from what I can tell, the purpose of relying on a few big for-profit corporations is that they will (in theory) do what it takes to verify the identity of the person/party requesting the certificate. You know, since it's their job and sole purpose for existing. Except nothing could be further from the truth.
I've bought TLS certification a number of times, and not once have I provided any kind of information except what is required by the standard (country and host name), and as far as I can tell, it has been fully automated every time and never even touched by a human hand (but I'm not 100% sure about that). The closest I got to interacting with a human being in this context was the robot which telephoned me to record my name and listen to some code, but that's probably just some legal bullshit and only related to the purchase itself.
And why would I give them information that will be displayed to users if they look? It's clearly not required, and I have no interest whatsoever in doing so either. The only reason I and (presumably) most people who don't run Amazon.com or something like that purchase signing, is to get rid of the fake, bullshit errors that all the visitors would otherwise see. Basically, you are paying an extortion fee to the CA Mafia, supported by Firefox, Opera, Safari, Internet Explorer and so on.
So, since there is no actual benefit to anyone except for the Certificate Authority you pick to fork over cash to, the entire point of this system is defeated. Now, let me get something perfectly clear: I'm definitely not against the idea of allowing those who need it to "sign" their certificate with some kind of authority, but then they need to actually verify the identity! And the free/default method (self-signing) should of course not display any errors anywhere. At most, it might have a "yellow" colour of the address bar or something, as opposed to a green one for those who have actually provided details which have been truly verified by a "trusted" third party. (Today, the major browsers give sites with an "extended" verification (costs thousands of dollars a year) that "green bar" and a yellow/uncoloured one for those who have "only" paid for a useless phony certificate.)
The whole purpose of this system, unless I'm mistaken, was to give people shopping online the confidence and peace of mind to safely trust the store. It was not supposed to harass users of any site that has not paid a ransom to some evil business. And some of us aren't even allowed to pay them!
Yeah, that's right. I hope you've read that other article already, because I won't repeat all of this. Basically, CA companies are just the same as domain registrars: they only care about money and will cave in to harassments and revoke your certificate just as quickly as they will steal your domain if enough people send fake abuse reports. As you probably realize, this has happened to me. For instance, GlobeSSL deleted the certificate and started sending threatening and insulting e-mails about how they were "going to court" to sue me for having the nerve to give them money by using them to sign the TSL certificate for my 100% legal site which they accepted when they verified it (right? Because that's your job, remember?). Yeah, there are a lot of mentally ill people out there with power.
On the technical level, self-signed certificates provide the exact same security level as your Internet bank, provided that you actually connect to the right domain/IP address and not some similar one.
Naturally, sites that use TLS/SSL but have actually broken certificates should indeed have those big red warnings pop up in their clients' browser. I'm fully in agreement with that. "Broken" can mean a number of things, but it sure as hell doesn't mean "has not been signed by a mobster".
Perhaps the biggest question mark in this whole mess is why browser makers insist on making such a big deal about self-signed certificates. And no, the ability to "add an exception" or "install additional CAs" is not neither realistic for the average user nor sensible even for those who know how to.
History & the basics
Once upon a time, in the early-to-mid 1990s, the World-Wide Web was born and started attracting users. Right from the start (or at least more or less; we're talking 1994), the rather obvious decision (at the time) was made to have two separate protocols/schemas: "HTTP" and "HTTPS".
HTTP (HyperText Transfer Protocol), which is still the dominant one in the year of 2012, is quick, simple and entirely unencrypted. Any password or other information sent in either direction is sent in plain text and can be trivially "sniffed" by anyone at any point in the network between your computer and the destination.
HTTPS (HyperText Transfer Protocol Secure), which has traditionally primarily been used for e-commerce and online bank interfaces, is much more "expensive" to compute (AKA slower) but uses TLS (previously SSL) as an "encryption wrapper" around HTTP. HTTPS is HTTP with encryption. In later years, it has become far more common for perceivably "non-critical" sites such as Wikipedia or Google Search to offer such an interface, and many sites use it only for the login form to save resources while still giving their users some protection.
Note: "TLS" is the successor to "SSL". SSL is still a very common term, but technically wrong when one is referring to TLS, which you more or less always are. Of course, that doesn't stop people from confusing them and capitalizing on the established but now incorrect term.
As for the bad news…
While this doesn't exactly have anything to do with Web sites specifically, since TLS/SSL can and are used for many other tasks, this "Certificate Authority" system is built around the idea of "ultimately trusted and authoritative parties" which are shipped with every browser on every computer.
The technical details of setting up a TLS certificate are messy and off-topic here, and also vary between Web servers and systems, but what you need to know is this: somebody must "sign" it. In practice, this means one of these huge, "trusted" companies, or yourself. Yeah, that's right. You can "self-sign" your certificates, and this would be good enough, except for the little, minor issue that if you do, every single visitor to your Web site is going to get big, flashing, red warnings urging you to not trust this horribly insecure and untrusted site which is all broken and stuff.
I'm not kidding. All modern browsers try their very best to make you close the tab entirely and surf elsewhere. Even when you know as much as I do about this, it's still scary to see it. It really makes you question the site, even though there is no technical reason to. Let me explain…
For this reason, since browser authors have all ganged up behind the CA Mafia, you have to either use HTTP (unthinkable in many cases) or forget about self-signing and pay one of the companies. If they will even let you. I'll get back to that.
Apparently, from what I can tell, the purpose of relying on a few big for-profit corporations is that they will (in theory) do what it takes to verify the identity of the person/party requesting the certificate. You know, since it's their job and sole purpose for existing. Except nothing could be further from the truth.
Why it's a joke
I've bought TLS certification a number of times, and not once have I provided any kind of information except what is required by the standard (country and host name), and as far as I can tell, it has been fully automated every time and never even touched by a human hand (but I'm not 100% sure about that). The closest I got to interacting with a human being in this context was the robot which telephoned me to record my name and listen to some code, but that's probably just some legal bullshit and only related to the purchase itself.
And why would I give them information that will be displayed to users if they look? It's clearly not required, and I have no interest whatsoever in doing so either. The only reason I and (presumably) most people who don't run Amazon.com or something like that purchase signing, is to get rid of the fake, bullshit errors that all the visitors would otherwise see. Basically, you are paying an extortion fee to the CA Mafia, supported by Firefox, Opera, Safari, Internet Explorer and so on.
So, since there is no actual benefit to anyone except for the Certificate Authority you pick to fork over cash to, the entire point of this system is defeated. Now, let me get something perfectly clear: I'm definitely not against the idea of allowing those who need it to "sign" their certificate with some kind of authority, but then they need to actually verify the identity! And the free/default method (self-signing) should of course not display any errors anywhere. At most, it might have a "yellow" colour of the address bar or something, as opposed to a green one for those who have actually provided details which have been truly verified by a "trusted" third party. (Today, the major browsers give sites with an "extended" verification (costs thousands of dollars a year) that "green bar" and a yellow/uncoloured one for those who have "only" paid for a useless phony certificate.)
The whole purpose of this system, unless I'm mistaken, was to give people shopping online the confidence and peace of mind to safely trust the store. It was not supposed to harass users of any site that has not paid a ransom to some evil business. And some of us aren't even allowed to pay them!
Yeah, that's right. I hope you've read that other article already, because I won't repeat all of this. Basically, CA companies are just the same as domain registrars: they only care about money and will cave in to harassments and revoke your certificate just as quickly as they will steal your domain if enough people send fake abuse reports. As you probably realize, this has happened to me. For instance, GlobeSSL deleted the certificate and started sending threatening and insulting e-mails about how they were "going to court" to sue me for having the nerve to give them money by using them to sign the TSL certificate for my 100% legal site which they accepted when they verified it (right? Because that's your job, remember?). Yeah, there are a lot of mentally ill people out there with power.
Final words
On the technical level, self-signed certificates provide the exact same security level as your Internet bank, provided that you actually connect to the right domain/IP address and not some similar one.
Naturally, sites that use TLS/SSL but have actually broken certificates should indeed have those big red warnings pop up in their clients' browser. I'm fully in agreement with that. "Broken" can mean a number of things, but it sure as hell doesn't mean "has not been signed by a mobster".
Perhaps the biggest question mark in this whole mess is why browser makers insist on making such a big deal about self-signed certificates. And no, the ability to "add an exception" or "install additional CAs" is not neither realistic for the average user nor sensible even for those who know how to.
(Edited 2 minutes later.)
Anonymous A (OP) replied with this 14 years ago, 44 minutes later, 2 hours after the original post[^] [v] #309,491
@309,460 (Lee O'Nidas !nBpim1wazU)Dogpile still exists? I remember my father using that.
@309,456 (Lee O'Nidas !nBpim1wazU)
A duckduckgo website? lolwut
@309,477 (r04r !GETFUCKED)
What I find funny is that it does this for Google.com.
@previous (HaikerensGuide !0VegJ9Jl.Q)
I read this whole thing without ever once following the link to see it came from Kimmo's website.
r04r !GETFUCKED replied with this 14 years ago, 14 minutes later, 2 hours after the original post[^] [v] #309,502
vocalon !M9.6XYhKxM joined in and replied with this 14 years ago, 45 minutes later, 3 hours after the original post[^] [v] #309,509
@309,456 (Lee O'Nidas !nBpim1wazU)
diagnosis: autism
@OP
Some sites are self-signed. HTTPS ill send a false positive.
diagnosis: autism
@OP
Some sites are self-signed. HTTPS ill send a false positive.
Anonymous A (OP) replied with this 14 years ago, 29 minutes later, 3 hours after the original post[^] [v] #309,510
@309,502 (r04r !GETFUCKED)There is also a pop up bar that reads, "This page has insecure content. Don't load (recommended) Load anyway".
Here's what it says when I click the lock.
r04r !GETFUCKED replied with this 14 years ago, 7 minutes later, 3 hours after the original post[^] [v] #309,511
@previous (A)
All that means is that the page loads an image, stylesheet or anything from a non-encrypted connection. The page itself and its contents are encrypted just fine.
All that means is that the page loads an image, stylesheet or anything from a non-encrypted connection. The page itself and its contents are encrypted just fine.
Anonymous A (OP) replied with this 14 years ago, 5 minutes later, 3 hours after the original post[^] [v] #309,513
@previous (r04r !GETFUCKED)
What would it possibly be loading on a page that is practically just a search bar?
Also, I used Chrome for the past couple of hours and god damn, its page rendering is so fast compared to Firefox. It makes me want to use it more.
What would it possibly be loading on a page that is practically just a search bar?
Also, I used Chrome for the past couple of hours and god damn, its page rendering is so fast compared to Firefox. It makes me want to use it more.
r04r !GETFUCKED replied with this 14 years ago, 14 minutes later, 4 hours after the original post[^] [v] #309,515
Anonymous A (OP) replied with this 14 years ago, 23 hours later, 1 day after the original post[^] [v] #309,822
Okay... this is starting to get annoying. And apparently rapidshare and download sites like it are insecure and prevent me from downloading.r04r !GETFUCKED replied with this 14 years ago, 4 minutes later, 1 day after the original post[^] [v] #309,825
@previous (A)
The sites aren't insecure, you dimwit. They load other insecure content. It works exactly the same in firefox, but I think Chrome is more vocal about it, though I haven't seen those notices myself. Look around the settings, maybe you can turn it off or there is a don't warn me again button.
The sites aren't insecure, you dimwit. They load other insecure content. It works exactly the same in firefox, but I think Chrome is more vocal about it, though I haven't seen those notices myself. Look around the settings, maybe you can turn it off or there is a don't warn me again button.
Anonymous A (OP) replied with this 14 years ago, 3 minutes later, 1 day after the original post[^] [v] #309,827
r04r !GETFUCKED replied with this 14 years ago, 1 minute later, 1 day after the original post[^] [v] #309,828
squeegee !firstkPE1Q joined in and replied with this 14 years ago, 45 minutes later, 1 day after the original post[^] [v] #309,842
maybe because https is needy and Chrome is sick and tired of it