Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 83 introduces HTTPS-Only Mode

blog.mozilla.org

Post reply on HN
Print view View original

71–80 of 525 posts

Re: Firefox 83 introduces HTTPS-Only Mode

#71

Post by akalsz »

AlexSW wrote: post #41
abraxaz wrote: post #34

Great to see this built into firefox, I have been using HTTPS Everywhere https://www.eff.org/https-everywhere to achieve similar results, it won't warn you if it is not https (i think) but it will try and upgrade to https if it can. It is available for chrome and firefox. What particularly annoyed me was using http to sites which supported https.

For me at least it warns me very blatantly and I have to asked to go to an insecure site if it's HTTP only. Perhaps we don't have the same configuration.

That's not enabled by default, you first have to flip the "Encrypt All Sites Eligible" switch.

Re: Firefox 83 introduces HTTPS-Only Mode

#72

Post by hsbauauvhabzb »

murphy1312 wrote: post #49
kanox wrote: post #24

Earlier quoted context omitted.

HTTPS is not about gatekeeping, you can use "let's encrypt" for free certificates for any domain. HTTPS-only is about forcing all traffic to be encrypted by banning clear-text traffic. I've been using the "HTTPS everywhere" extension for years and it's great.

yes it is. someone has to give you a certificate which the users browser accepts. even if its free today. lets say a simple website which someone uses to display some holiday pictures. why would we need https here, if there is no login or anything like that? it just adds an extra hurdle for not so tech-savvy users and increases the trend to abolish small private websites.

If my choices are to implement a security control which forces a layer of security, or forgo that security control so Alice can upload her Holiday pictures to a host which doesn’t support HTTPS either, I know which one I’ll pick. Alice should either host her photos on Instagram, or learn how to run letsencrypt.

The day where certs are no longer freely obtainable is the day another self governed free TLS provider will appear and force their way into the market by providing installers to inject CAs into system cert stores.

There’s always TOR if you disagree.

Re: Firefox 83 introduces HTTPS-Only Mode

#73

Post by rakoo »

murphy1312 wrote: post #49
kanox wrote: post #24

Earlier quoted context omitted.

HTTPS is not about gatekeeping, you can use "let's encrypt" for free certificates for any domain. HTTPS-only is about forcing all traffic to be encrypted by banning clear-text traffic. I've been using the "HTTPS everywhere" extension for years and it's great.

yes it is. someone has to give you a certificate which the users browser accepts. even if its free today. lets say a simple website which someone uses to display some holiday pictures. why would we need https here, if there is no login or anything like that? it just adds an extra hurdle for not so tech-savvy users and increases the trend to abolish small private websites.

As a visitor to the website, how can I be sure it's only holiday pictures ? If I get to your friendly website and it asks me for private information, and I'm willing to give it because I trust you, what tells me only you will receive it ? How do I know it's your holiday pictures, and not some scam someone else wants to trick me into ?

Re: Firefox 83 introduces HTTPS-Only Mode

#74

Post by dalu »

jevgeni wrote: post #56
everfree wrote: post #25

Earlier quoted context omitted.

> Perhaps one of the downvoters can explain why the implied opinion "Nobody should be able to access your site without clearance from a third-party gatekeeper" belongs on a site called "Hacker News." I didn't vote down, but ironically this is news to real hackers who will have a harder time doing mitm downgrade attacks once this is widespread. I believe that web browsers should alert users if a website uses a less se…

Which means any pure HTML resources would either have to rely on let’s encrypt or pony up some certificate money. So basically a death knell for homepages.

especially if the diplayed warning looks like a "ThIs Is An InSeCuRe SiTe" warning. self signed cert? WaRnInG!!!111eleven no https? WaRnInG!!!111eleven cert expired 2 hours ago? WaRnInG!!!111eleven

Re: Firefox 83 introduces HTTPS-Only Mode

#75

Post by stephen_g »

mittermayr wrote: post #40
whym wrote: post #23

I wonder how it will work against websites like http://neverssl.com (which helps me to log in to some wifi portals, HTTPS Everywhere shows the prompt for a temporary exception.)

An alternative I use is http://captive.apple.com (other OS vendors have their own). Which may have a higher chance of being detected by the portal (more likely to be white-listed) and triggering the prompt correctly.

Frustratingly it doesn’t always work that way - one I have seen that is just bizarre is Qantas inflight wifi. It actually allows captive.apple.com to bypass the captive portal, so your iPhone, iPad or Mac thinks it has internet access. So you try to navigate to a page or use an app and just hit HTTPS certificate errors! So you have to think of some other site that is only HTTP or get the information card and enter the address it tells you to log in!

It’s crazy, because somebody must have had to configure something to explicitly let that through (not understanding the purpose of it?) and it just completely breaks it! I’ve tried to leave feedback (there is a link from the portal page) that they’ve screwed it up but it hadn't been fixed the last flight I went on..

Re: Firefox 83 introduces HTTPS-Only Mode

#77

Post by implying »

This is a great step, but I wish browsers would allow you to set domains that are considered to be secure origins in all cases. I have a decent intranet with transport security guaranteed by VPN, but because it isn't "HTTPS" I can't access tons of browser features.

Re: Firefox 83 introduces HTTPS-Only Mode

#78

Post by autoexec »

m4lvin wrote: post #69
ffpip wrote: post #55

I've used this for a few months now. It ugrades non-https connections on secure pages automatically. Very useful. Even big sites like microsoft, google images serve things over http dom.security.https_only_mode = true

Thanks for mentioning this! This about:config flag is also available in Firefox ESR 78 already (but there is no GUI for it yet).

Are there about:config entries to handle excluded sites?

Re: Firefox 83 introduces HTTPS-Only Mode

#79

Post by dewey »

jevgeni wrote: post #66
dewey wrote: post #59

Earlier quoted context omitted.

Using https is making the web a monoculture?

It obviously is. Having just an HTML site now becomes more expensive for no clear reason. Which makes more sense for people to check out Gemini.

What makes it more expensive? A certificate is free (With LE or self-signed), the performance impact is negligible and there's a clear reason for why everyone should be using it.

Re: Firefox 83 introduces HTTPS-Only Mode

#80

Post by dspillett »

whym wrote: post #23

I wonder how it will work against websites like http://neverssl.com (which helps me to log in to some wifi portals, HTTPS Everywhere shows the prompt for a temporary exception.)

I'll have to remember that for next time I get "wireless on the train doesn't work, I get some security error" via SMS.

Last time I pointed them at one of my sub-domains that still serves plain HTTP to bring up the captive portal (which wasn't trying to charge, or apparently even advertise, the network just insisted you hit it at least once to be told "Hello!" and presumably have your MAC added to the whitelist for a time).

The name "neverssl" might confuse non-techies though. Maybe I'll register something like iswirelessbroken.com for doing the same thing.

Post reply on HN