Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 83 introduces HTTPS-Only Mode

blog.mozilla.org

Post reply on HN
Print view View original

61–70 of 525 posts

Re: Firefox 83 introduces HTTPS-Only Mode

#61

Post by ce4 »

tobylane wrote: post #52
jchw wrote: post #18

I’m surprised at the negative knee-jerk reaction. I actually love this idea immediately. It encapsulates something I kind of already wanted when using HTTPS Everywhere. This doesn’t guarantee the transport is end-to-end secure; I’m sure plenty will strip the encryption at an LB and then possibly send it back over the internet. But, I think it’s a good addition nevertheless. Here’s to hoping for more DoH and encrypted…

Could this or HTTPS Everywhere warn you when a site is known for encryption stripping? I think this happens on the free cloudflare tier and we can’t determine that.

How would you detect something like that? Thats at the discretion of the party running the webserver/service and it's not directly observable. Cloudflare acts as a reverse proxy in front of the real origin server (which uses https), but that affects really a lot of internet sites nowadays (Cloudflare, Akamai, aws/gcp/azure and so on). CDN-origin connectivity is also encrypted, afaik you cannot downgrade and strip ssl (at least not with Akamai)

Re: Firefox 83 introduces HTTPS-Only Mode

#62

Post by kijin »

y7 wrote: post #38

Finally! I've been waiting for HTTPS to be the default for a while now. From a security standpoint it's annoying that bar something like HSTS it's trivial for a man in the middle to force a downgrade to non-secure HTTP. The fix is to force yourself as a user to look for the lock symbol in the address bar, but that's terrible from a usability perspective. However, I'm not sure whether it'd be best to make this the mod…

That's why it's important for features like this to be enabled in at least a couple of major browsers at roughly the same time. That way, users will blame the website operator instead of the browser when they suddenly can't access an insecure website.

Re: Firefox 83 introduces HTTPS-Only Mode

#63

Post by dalu »

Deukhoofd wrote: post #13
CamperBob2 wrote: post #7

There had better be an about:config option to turn this stupidity off. Perhaps one of the downvoters can explain why the implied opinion "Nobody should be able to access your site without clearance from a third-party gatekeeper" belongs on a site called "Hacker News." And no, it won't be opt-in for long. Read the rest of the page: "Once HTTPS becomes even more widely supported by websites than it is today, we expect…

Did you read the article? It clearly states it's opt-in.

At first it's opt-in then it becomes the default setting. Are you a developer? If you are then you should be used to thinking at least 2 steps ahead and just seeing what's literally visible in front of you.

Re: Firefox 83 introduces HTTPS-Only Mode

#64

Post by lokedhs »

murphy1312 wrote: post #49
kanox wrote: post #24

Earlier quoted context omitted.

HTTPS is not about gatekeeping, you can use "let's encrypt" for free certificates for any domain. HTTPS-only is about forcing all traffic to be encrypted by banning clear-text traffic. I've been using the "HTTPS everywhere" extension for years and it's great.

yes it is. someone has to give you a certificate which the users browser accepts. even if its free today. lets say a simple website which someone uses to display some holiday pictures. why would we need https here, if there is no login or anything like that? it just adds an extra hurdle for not so tech-savvy users and increases the trend to abolish small private websites.

I don't know. Let's say that some non-technical family member goes to this site intending to look at vacation pictures.

Imagine if those pictures have been replaced by something else. If you can't think of a long list of replacement images that could be very useful for a spearphishing attack, then you're not having enough imagination.

This attack could also be used to get the poster of the photos in trouble.

Re: Firefox 83 introduces HTTPS-Only Mode

#65

Post by AntiImperialist »

ffpip wrote: post #54
AntiImperialist wrote: post #43

I have been using HTTPS Everywhere for many years: https://www.eff.org/https-everywhere

Yes, but one less extension with access to all your history, passwords and all other info.

I'm not sure if I trust EFF any less than I trust Mozilla.

Re: Firefox 83 introduces HTTPS-Only Mode

#66

Post by jevgeni »

dewey wrote: post #59
m_eiman wrote: post #53

It's obvious I need to spend more time researching Gemini and similar things. The "web" is going to be a true monoculture very, very soon.

Using https is making the web a monoculture?

It obviously is. Having just an HTML site now becomes more expensive for no clear reason. Which makes more sense for people to check out Gemini.

Re: Firefox 83 introduces HTTPS-Only Mode

#67

Post by hpfr »

ffpip wrote: post #54
AntiImperialist wrote: post #43

I have been using HTTPS Everywhere for many years: https://www.eff.org/https-everywhere

Yes, but one less extension with access to all your history, passwords and all other info.

WebExtensions have permissions and I doubt the EFF requests passwords and history for this extension. It’s also open-source, and although installing it from addons.mozilla.org could introduce some sort of MITM opportunity, as a recommended extension Mozilla puts it through a review process, so it’s about as tame as an extension this capable can get. But yes, it is always nice to reduce extensions installed.

Re: Firefox 83 introduces HTTPS-Only Mode

#69

Post by m4lvin »

ffpip wrote: post #55

I've used this for a few months now. It ugrades non-https connections on secure pages automatically. Very useful. Even big sites like microsoft, google images serve things over http dom.security.https_only_mode = true

Thanks for mentioning this! This about:config flag is also available in Firefox ESR 78 already (but there is no GUI for it yet).
Post reply on HN