Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 83 introduces HTTPS-Only Mode

blog.mozilla.org

Post reply on HN
Print view View original

81–90 of 525 posts

Re: Firefox 83 introduces HTTPS-Only Mode

#81

Post by antonyh »

dusted wrote: post #60
m_eiman wrote: post #53

It's obvious I need to spend more time researching Gemini and similar things. The "web" is going to be a true monoculture very, very soon.

I agree. HTTPS is great, at definitely needed for a lot of things. But I don't need my cat pictures encrypted, I don't need lots of things encrypted, and frankly, I don't want it to be encrypted when it's not required, it's a waste of resources, both processing and network. Then there is the case of all the old computers that either lack the processing power or support for modern algorithms.

When there's executable code there needs to be encryption.

JS HTML CSS WASM etc ...all need to be tamper-resistant.

Processing power, meh. More of an issue is older devices not getting the updates to software for the newer algorithms, and not getting the updated certificates. I got rid of a perfectly good tablet for just this reason. A bit slow perhaps but workable.

Re: Firefox 83 introduces HTTPS-Only Mode

#82

Post by Cthulhu_ »

pjc50 wrote: post #45
jchw wrote: post #18

I’m surprised at the negative knee-jerk reaction. I actually love this idea immediately. It encapsulates something I kind of already wanted when using HTTPS Everywhere. This doesn’t guarantee the transport is end-to-end secure; I’m sure plenty will strip the encryption at an LB and then possibly send it back over the internet. But, I think it’s a good addition nevertheless. Here’s to hoping for more DoH and encrypted…

DoH changes who gets all your DNS traffic from your ISP and your router to (in practice) a single central DoH provider. Which of those you trust least depends on who you are.

Can a user use multiple (fallback) DNS-over-HTTPS providers? Do the DoH providers supply fallbacks (which iirc most DNS providers do)?

Re: Firefox 83 introduces HTTPS-Only Mode

#83

Post by matsemann »

jchw wrote: post #18

I’m surprised at the negative knee-jerk reaction. I actually love this idea immediately. It encapsulates something I kind of already wanted when using HTTPS Everywhere. This doesn’t guarantee the transport is end-to-end secure; I’m sure plenty will strip the encryption at an LB and then possibly send it back over the internet. But, I think it’s a good addition nevertheless. Here’s to hoping for more DoH and encrypted…

> I’m surprised at the negative knee-jerk reaction.

Only Chrome is allowed to break stuff on the web, remember?

Re: Firefox 83 introduces HTTPS-Only Mode

#84

Post by autoexec »

dusted wrote: post #60
m_eiman wrote: post #53

It's obvious I need to spend more time researching Gemini and similar things. The "web" is going to be a true monoculture very, very soon.

I agree. HTTPS is great, at definitely needed for a lot of things. But I don't need my cat pictures encrypted, I don't need lots of things encrypted, and frankly, I don't want it to be encrypted when it's not required, it's a waste of resources, both processing and network. Then there is the case of all the old computers that either lack the processing power or support for modern algorithms.

I'd be more receptive to this if ISPs weren't snooping on traffic and selling their customer's browsing history. As long as we have to operate under the assumption that every scrap of data we send or request will be picked apart and used against us whenever possible I'd rather encrypt everything and have a little less to worry about.

Re: Firefox 83 introduces HTTPS-Only Mode

#85

Post by dspillett »

stephen_g wrote: post #75
mittermayr wrote: post #40

Earlier quoted context omitted.

An alternative I use is http://captive.apple.com (other OS vendors have their own). Which may have a higher chance of being detected by the portal (more likely to be white-listed) and triggering the prompt correctly.

Frustratingly it doesn’t always work that way - one I have seen that is just bizarre is Qantas inflight wifi. It actually allows captive.apple.com to bypass the captive portal, so your iPhone, iPad or Mac thinks it has internet access. So you try to navigate to a page or use an app and just hit HTTPS certificate errors! So you have to think of some other site that is only HTTP or get the information card and enter th…

Perhaps they were told to make Apple stuff work without login, and just blindly whitelisted all known Apple host address ranges.

Re: Firefox 83 introduces HTTPS-Only Mode

#86

Post by visarga »

dusted wrote: post #60
m_eiman wrote: post #53

It's obvious I need to spend more time researching Gemini and similar things. The "web" is going to be a true monoculture very, very soon.

I agree. HTTPS is great, at definitely needed for a lot of things. But I don't need my cat pictures encrypted, I don't need lots of things encrypted, and frankly, I don't want it to be encrypted when it's not required, it's a waste of resources, both processing and network. Then there is the case of all the old computers that either lack the processing power or support for modern algorithms.

> I don't need my cat pictures encrypted

Because all images are of cats or it's easy to tell when it's sensitive and when not.

Re: Firefox 83 introduces HTTPS-Only Mode

#87

Post by iso1631 »

jchw wrote: post #18

I’m surprised at the negative knee-jerk reaction. I actually love this idea immediately. It encapsulates something I kind of already wanted when using HTTPS Everywhere. This doesn’t guarantee the transport is end-to-end secure; I’m sure plenty will strip the encryption at an LB and then possibly send it back over the internet. But, I think it’s a good addition nevertheless. Here’s to hoping for more DoH and encrypted…

I want my OS to do DNS - including DOH, not my browser. I want a single source for my DNS

I want my network to tell me a DNS server to use. As I own my computer I can override that, but much of the time I want to use the network provided DNS server.

Re: Firefox 83 introduces HTTPS-Only Mode

#88

Post by speedgoose »

Deukhoofd wrote: post #48
conradludgate wrote: post #30

Earlier quoted context omitted.

According to another comment, you can still allow certain sites through http, so your Internet dev sites are still fine but the global sites will be blocked by default

Sure, but we have like 50 different internal domains for different customers, so that would get annoying real fast ;)

You could use a self signed certificate.

Re: Firefox 83 introduces HTTPS-Only Mode

#89

Post by Neil44 »

CamperBob2 wrote: post #7

There had better be an about:config option to turn this stupidity off. Perhaps one of the downvoters can explain why the implied opinion "Nobody should be able to access your site without clearance from a third-party gatekeeper" belongs on a site called "Hacker News." And no, it won't be opt-in for long. Read the rest of the page: "Once HTTPS becomes even more widely supported by websites than it is today, we expect…

I kind of agree, I don't want to have to click through warnings all the time to do my job. Just re-architect everything to have legit public domain names and network access to get a let's encrypt cert, yeah right I'll get right on that.

Re: Firefox 83 introduces HTTPS-Only Mode

#90

Post by madjam002 »

implying wrote: post #77

This is a great step, but I wish browsers would allow you to set domains that are considered to be secure origins in all cases. I have a decent intranet with transport security guaranteed by VPN, but because it isn't "HTTPS" I can't access tons of browser features.

Isn't this what HSTS does? Maybe a way to manually add domains to the list would be good.
Post reply on HN