16

One week ago Google sent me an email to go HTTPS. If I won't transfer HTTP to HTTPS then it will show my connection unsecured to all of my site visitors who will try to input text in my site.

Without using SSL, is there any other way to make my connection secured ? As it is related to costly process to use SSL in web URL, I am searching for any other option instead.

  • 27
    Have you looked into letsencrypt.org? It issues free HTTPS certificates. It is a bit of a pain to set up from scratch, but many hosting companies have implemented it for you. – Stephen Ostermiller Aug 23 '17 at 11:59
  • 6
    You can also use cloudflare which'll give you an SSL cert for free. – Ave Aug 23 '17 at 21:30
  • 2
    The question is not "how to use HTTPS", but broader than that: if http:// is not OK, what else is there besides https://? Is there a abc://, lgbtqiapk+:// or dps://? – Konerak Aug 24 '17 at 11:51
  • 4
    "Costly process"? Let's encrypt is free. Also: doesmysiteneedhttps.com – Andrea Lazzarotto Aug 24 '17 at 16:49
41

is there any other way to make my connection secured ?

Google isn't just complaining about "security" (which could include a number of different topics), it is specifically targeting encryption / HTTPS. With plain HTTP the connection between the client and server is unencrypted, allowing anyone to potentially see and intercept anything that is submitted. It would normally only prompt with this if you are allowing users to login (ie. submitting username/password) or submitting payment information over an unencrypted connection. General "text" form submissions would not necessarily be a problem. However, as @Kevin pointed out in comments, Google/Chrome plan to extend this in the future:

Eventually, we plan to label all HTTP pages as non-secure, and change the HTTP security indicator to the red triangle that we use for broken HTTPS.

Installing an SSL cert on your site (or using a front-end proxy like Cloudflare to handle the SLL) is the only way to encrypt the traffic to your site.

However, this isn't necessarily a "costly process" these days. Cloudflare have a "free" option and Let's Encrypt is a free Certificate Authority that many hosts support by default.

  • 3
    "It would normally only prompt with this if you are allowing users to login (submitting username/password) or submitting personal information over an unencrypted connection. General "text" would not necessarily be a problem." This will soon no longer be true; Chrome will show the warning for ANY text entry field. It can't tell the difference between potentially sensitive information and benign stuff like searches, after all, so the decision was made to just warn on everything. – Muzer Aug 23 '17 at 16:49
  • 2
    @Muzer It's also generally not decidable if text input is sensitive -- if I type in my home address, or do a search for my embarrassing medical problem, those could be very interesting to an eavesdropper. – apsillers Aug 23 '17 at 17:03
  • 6
    Eventually, Chrome will show this warning for all HTTP sites, so there is no long-run alternative to HTTPS. – Kevin Aug 23 '17 at 17:05
  • 3
    This answer is missing the biggest advantage to HTTPS over plain end-to-end encryption, which is identity. HTTPS allows your server to prove to its clients that it is actually the server it claims to be without having to specifically arrange a method of authentication ahead of time. End-to-end encryption on its own doesn't help if the client has connected to a server owned by a malicious actor. – IllusiveBrian Aug 23 '17 at 21:54
  • 4
    @IllusiveBrian Although this question is not really about the "advantages of HTTPS" (there are existing questions that already cover that), this question is about trying to avoid the browser security "warning" in Google/Chrome. But HTTPS doesn't necessarily "prove identity" - to do that you would need to pay more money for an OV or EV cert. In the context of this question it is all about encryption. – DocRoot Aug 23 '17 at 22:58
4

I don't recommend, but you can bypass this message, by not using the original input text fields. You can create your own input fields, using regular div that have onkeypress event. Or you can create a div element that have the contenteditable attribute set to true.

This way, the users will be able to input information on your site, without using input tag elements.

  • 41
    This is a really bad idea. It doesn't solve the security problem that Google are encouraging you to solve, and is likely to cause problems for users who are using your site in a slightly different way to how you've tested it (e.g. a different browser, a phone, a screen reader etc). It will also likely break password managers. – thelem Aug 23 '17 at 14:26
  • Posting the form would be problematic with this approach. – the_lotus Aug 23 '17 at 14:36
  • 3
    You don't need t post the FORM. You can use XMLlHTTPRequest (aka AJAX) for sending the information – Aminadav Glickshtein Aug 23 '17 at 14:50
  • 18
    I would change you answer from "don't recommend" to "never ever do this". You are circumventing so many standards doing this you might as well not be making a web application anymore. – Caimen Aug 23 '17 at 18:55
  • 2
    Do I really need 125 points to downvote this thing? o.O – Andrea Lazzarotto Aug 24 '17 at 16:52
4

If you're just serving static files or can put a proxy in front you could use a server like caddy server which handles all of this for you by using lets encrypt, this takes the pain out of provisioning certificates and you don't have to install any other software.

Alternatively you could use a service like cloudflare - their free plan offers free https.

Finally, some hosts offer free https certs now, including dreamhost. So check if your current host offers this as an option.

I wouldn't recommend trying to find a workaround, there is only one way to make your site secure, and browsers will eventually be warning on every site that doesn't have https, no matter what the content. The web is moving towards https everywhere.

  • 1
    Firefox has introduced warnings too now on insecure login pages, and all major browsers have chosen to provide http2 only with https support, which means the next version of the protocol is de-facto https only. – Kenny Grant Aug 23 '17 at 20:55
  • 1
    @closetnoc GoDaddy is a rip-off in multiple ways. We (webdev company) used to buy our certs for €7 per year, which was affordable but not for a hundred sites. Now, we're using Let's Encrypt and get them for free so we've put SSL on all of them. Our customers like it and we enjoy using HTTP/2. Have had no problems with renewal. Certs last 90 days and we start trying to renew daily after 60 days. Plenty of overlap in case something goes wrong (which it hasn't). Use Cloudflare if you don't want the hassle. – Martijn Heemels Aug 24 '17 at 9:11
  • 1
    @closetnoc ssl is more than encryption, it also ensures integrity, security and privacy, so stuff on page can't be seen (e.g your employer, a survillance state) or changed (e.g injected ads) by a MitM'er. Also, it prevents people from MitMing to sniff your friend's authentication data (which can probably be used to upload unwanted content to the site). Also, a Martijn said, GoDaddy is a huge ripoff, and overall are unfavorable. I'd recommend your friend to look at google domains, namecheap and gandi (I'm not affiliated with any). – Ave Aug 24 '17 at 11:30
  • 1
    @MartijnHeemels I agree GoDaddy is overpriced. BIG TIME! It looks like Let's Encrypt is the way to go for most sites that are generally benign in content. I can see going for fully vetted certs for some sites too. Would you believe I used to be a cert authority? I guess I prefer when certs were a year. I don't trust shorter time periods. But what choices are there these days? Cheers!! – closetnoc Aug 24 '17 at 14:22
  • 1
    @closetnoc It's not hard to find paid SSL certs from well-recognized CAs with 1-year validity for about $10 apiece. But that obviously won't get you a "fully vetted" certificate; if you really want that, you need to jump through the hoops to get an EV cert, and pay the corresponding price (and as has been pointed out previously, not even EV certs are perfect or come without caveats). Let's Encrypt discusses some of the reasons why their certs are only valid for 90 days on their web site, but the existence of Let's Encrypt has not (yet) caused commercial CAs to pull their DV cert offerings. – a CVn Aug 24 '17 at 14:34
4

nobody else seems to have mentioned,

if you own every machine that connects to your site

eg "this is probably not what you want"

, like a corporate setting, you can create a certificate authority of your own, install it's public cert into all the machines (well onto all the browsers and cert stores) that connect to your site. this option is free of third party monetization; it's the same encryption cipher, you don't get signed into the public trust though (eg your authority is not recognised by Google's Chrome, Mozilla's Firefox etc, the way Let's Encrypts's does) but it will be recognised by machines you configured to trust yourself.

admittedly the deals off setting up a certificate authority are tricky somewhat obscure and maintenance can be a lot of work- so I'll leave them off here, you're probably best doing a deep dive research on the topic of you're truly interested in this approach.

though for a nieve deployment, if you can try XCA

XCS is is a decent way to issue certs for tiny deployments and includes help documentation that walks through the whole setup.

  • 2
    You'll almost certainly spend more setting up your own CA (in labor hours, if nothing else) than by purchasing a commercial SSL cert. Then, there's always the possibility of doing something wrong. – Eric J. Aug 27 '17 at 2:37
1

I have a couple of ideas.

If the reason for HTTPS is to manage logins, then you can minimize the effect across all browsers by offering users to stay logged in. Then when a user logs in, a cookie can be permanently stored on the user's computer so the next time the user turns his computer on to access the site, he would be automatically logged in instead of always being presented with a login prompt and possibly a security warning.

Another idea which can bypass the message but which would be more work on both the guest and the server is to have a guest upload a special file with the proper configuration encrypted. For example, for the login screen, instead of asking the user to enter his username and password in two text boxes, have the user upload a small file that contains his username and password encrypted (for example, compressing the username and password as a zip file with a specific compression level) then the server can decrypt the file to extract the username and password. The potential hacker will see gibberish in transit when the user sends the file to the server. Only slight advantage to this idea is a slightly faster connection speed since SSL connection processing doesn't take place in HTTP.

  • An upcoming version of Chrome will be warning about any text input, not just password fields. Any data that uses HTML forms will need to be HTTPS to avoid warnings, not just login. Google has been sending out notifications via Search Console to website owners whose websites Google thinks will be effected. – Stephen Ostermiller Aug 25 '17 at 8:14
1

No.

Any hack you try (eg like trying to encrypt with javascript), is very unlikely to even be close to secure.

SSL doesnt have to "expensive", many hosting providers offer it for free. And even things like cloudflare offer free SSL, and keep current hosting.

-3

A free, quick solution is Let's Encrypt. Link They have documentation for nearly every server OS. We use it at our work, and our W2P vendors use it to secure each of our storefronts.

  • 3
    This answer doesn't add anything that hasn't already been said. – Stephen Ostermiller Aug 24 '17 at 16:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.