Google Inc. about the change in the approach to handling mixed content on pages served over HTTPS. Previously, a special indicator was displayed when there were components loaded without encryption (via http://) on HTTPS pages. In the future, it has been decided to block the loading of such resources by default. Thus, pages served over 'https://' will only contain resources loaded through a secure communication channel.
It is noted that currently, over 90% of websites are accessed by Chrome users using HTTPS. The presence of unencrypted inserts poses security risks through the modification of unsecured content when there is control over the communication channel (for example, when connecting via open Wi-Fi). The mixed content indicator has been deemed ineffective and misleading, as it does not provide a clear assessment of the page's security.
Currently, the most dangerous types of mixed content, such as scripts and iframes, are already blocked by default, but images, audio files, and videos can still be loaded via http://. By substituting images, an attacker can inject tracking cookies, attempt to exploit vulnerabilities in image handlers, or commit forgery by replacing the information presented in the image.
The introduction of blocking is divided into several stages. In Chrome 79, scheduled for December 10th, a new setting will appear that allows users to disable blocking for specific sites. This setting will apply to already blocked mixed content, such as scripts and iframes, and will be accessed through the menu that appears when clicking on the lock icon, replacing the previously suggested indicator for disabling blocking.
In Chrome 80, expected on February 4, a soft blocking scheme for audio and video files will be applied, implying automatic replacement of http:// links with https://, allowing functionality to be maintained if the problematic resource is also available via HTTPS. Images will continue to load unchanged, but if loaded via http:// on https:// pages, an insecure connection indicator will start to appear for the entire page. For automatic replacement to https or blocking of images, site developers can use CSP properties upgrade-insecure-requests and block-all-mixed-content. In the upcoming Chrome 81, scheduled for March 17, automatic replacement of images loaded via http:// to https:// will be enforced.
Additionally, Google is integrating a new component called Password Checkup into one of the upcoming releases of the Chrome browser, which in the form of . This integration will bring tools into Chrome's built-in password manager to analyze the strength of user passwords. When attempting to log into any site, the username and password will be checked against a database of compromised accounts, with a warning displayed if issues are found. The check is performed against a database covering over 4 billion compromised accounts that have appeared in user data leaks. A warning will also be shown when trivial passwords such as 'abc123' are used (according to Google, 23% of Americans use such passwords), or when the same password is used across multiple sites. To maintain privacy when accessing external APIs, only the first two bytes of the hash from the combination of the username and password are sent (using the algorithm
Argon2 blinding.«, where neither party knows the contents of the checked data. To protect against identifying the content of compromised account databases by guessing arbitrary prefixes, the returned data is encrypted with a key generated based on the checked combination of username and password.
Source: opennet.ru
