Chromium Blog: Towards HTTPS by default
Chromium Blog: Towards HTTPS by default
For the past several years, more than 90% of Chrome users' navigations have been to HTTPS sites, across all major platforms. Thankfully, th...
cross-posted from: https://lemmy.world/post/3301227
Chrome will be experimenting with defaulting to https:// if the site supports it, even when an http:// link is used and will warn about downloads from insecure sources for "high-risk files" (example given is an exe). They're also planning on enabling it by default for Incognito Mode and "sites that Chrome knows you typically access over HTTPS".
Chrome didn’t already default to https? Why?
It does if you just type in something like wikipedia.org . This most recent change they're working on is so that a link on a page to:
http://wikipedia.org will get redirected to https://wikipedia.org if the site supports it.
This will fix a bunch of old links that are still floating around on various sites, forums, etc and keep people on https, instead of doing the https -> http -> https redirect bouncing around that can happen now.
Pushing traffic to https isn’t the worst thing. My ask would be to have a toggle to disable due to local development or server deployments where http/port 80 is the only choice.
It does specifically say "defaulting to https:// if the site supports it", so I think specifying http will still work if the site doesn't actually support https.
Got a message back from Https, let's switch!
The message:
"Internal nginx routing error."
No testing a server side http-to-https upgrade/redirect without reconfiguring your browser. This seems like an unnecessary and bad idea.
This could be easily done better by promoting such server-side configurations as a default.
I mean, why should the browser attempt to correct inappropriately configured servers? Shouldn't they rather be making PRs to NGINX/Apache/CAs or whatever?
Also: can't this be exploited to spoof an unavailable HTTPS and coerce an unencrypted connection?
Not touching chromium or chrome. Sworry! Happy with Firefox.
What's the difference between the two?
I'm not sure which thing you're referring to.
If it's between http and https, the s stands for secure and the connection to the server is authenticated and encrypted.
Their Googlebot has been pushing https hard for years. I really don't see the point for mundane sites with no sensitive or controversial content, but there is no way to fight Google so like a good little site operator I go along if I want to be in Google search results.