Source: https://sites.google.com/a/chromium.org/dev/Home/chromium-security/deprecating-powerful-features-on-insecure-origins
We want to start by requiring secure origins for these existing features: - Device motion / orientation - EME - Fullscreen - Geolocation - getUserMedia()
I have built demos in the past which use these features which will now break. Also frustrating is that no console errors are thrown, nor exceptions. The APIs I've used just stopped working with no explanation.
For my next project, having the Orientation sensor blocked for non-SSL is actually frustrating, and requires that I generate SSL keys for home and my internet deployment.
I think moving to SSL-only for these features is premature for the state of SSL availability (expensive, complex). Overcoming these was actually a lot of work.
I eventually overcame issues with the SSL Certs working improperly, but still limited to only being freely available from a somewhat undesirable source (StartSSL).
For now, my setup is:
- Home -- Generate my own keys/certs using openssl, and just deal with the Red padlock on chrome.
- Internet -- Get signed certs from StartSSL
A few notes on how to overcome SSL issues with StartSSL can be seen in a prior post (link).
