Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 83 introduces HTTPS-Only Mode

blog.mozilla.org

Post reply on HN
Print view View original

91–100 of 525 posts

Re: Firefox 83 introduces HTTPS-Only Mode

#91

Post by globular-toast »

There's a phenomenon I observe quite regularly in tech. A problem exists and creative people develop an innovative solution to said problem. The solution then becomes popular and a singular goal of uncreative people who deploy said solution everywhere and push it to its logical extreme.

I remember seeing this in the mid-2000s when HTML tables were shunned in favour of "divs". I saw people reinventing tables using divs and CSS to display tabular data. Completely missing the point, of course.

This is an example of that for me. How can I possibly trust every single website I visit? It means nothing to connect to a news website, say, and see the "green padlock". Who am I trusting exactly? That I've successfully connected to some load balancer that is operated by "super-trustworthy-tech-news.com"? What's the use in that? Am I supposed to trust them more than some man-in-the-middle just because they own a domain name?

But maybe it's for privacy? If you want privacy you use tor. HTTPS does nothing for privacy when it's the same tech giant on the other end that is collecting all the data. It just means that said tech giant gets exclusive access to that data. Great.

All this does is train people to not care about security and to just trust us to do the right thing because they are too stupid to get it. Sooner or later there will be an event where a government compromises a CA. Bad luck. Some Americans already decided this was a solved problem and that this could never happen.

Re: Firefox 83 introduces HTTPS-Only Mode

#92

Post by dspillett »

Deukhoofd wrote: post #20

As a developer I likely won't use this feature much, considering most of our internal development sites are http only. For the general public it might be useful though, especially the auto-upgrade feature, protecting them from the lazy network operators that didn't add a proper auto-redirect.

> As a developer … most of our internal development sites are http only.

As a developer, should you not work against an environment closer to production behaviours? Otherwise you might miss performance issues (due to different caching behaviours between http/https) or other problems until your code is released.

Re: Firefox 83 introduces HTTPS-Only Mode

#93

Post by antonyh »

I'm for this. Any computer capable of running FF83 is powerful enough to use HTTPS everywhere.

What it doesn't do, is force good TLS - there's nothing to stop a site using a weak algorithm, SSLv2/3, or old TLS versions.

It also wrecks network-level caching using appliances like Squid.

Re: Firefox 83 introduces HTTPS-Only Mode

#94

Post by Deukhoofd »

ffpip wrote: post #57
Deukhoofd wrote: post #48

Earlier quoted context omitted.

Sure, but we have like 50 different internal domains for different customers, so that would get annoying real fast ;)

Well, you have to specifically enable this feature. So don't enable it.

Which indeed is why I said I likely will not use the feature above.

Re: Firefox 83 introduces HTTPS-Only Mode

#95

Post by iso1631 »

tobylane wrote: post #52
jchw wrote: post #18

I’m surprised at the negative knee-jerk reaction. I actually love this idea immediately. It encapsulates something I kind of already wanted when using HTTPS Everywhere. This doesn’t guarantee the transport is end-to-end secure; I’m sure plenty will strip the encryption at an LB and then possibly send it back over the internet. But, I think it’s a good addition nevertheless. Here’s to hoping for more DoH and encrypted…

Could this or HTTPS Everywhere warn you when a site is known for encryption stripping? I think this happens on the free cloudflare tier and we can’t determine that.

All HTTPS does is ensure security between your client and the server with the private key of the certificate. You typically trust certificate signers (globalsign, letsencrypt, etc) who have their own policies for ensuring who gets a certificate (in LE's case you have to prove ownership of the domain)

If a domain owner gets a certificate and gives it, and a private key, to a third party, then that's their business.

Re: Firefox 83 introduces HTTPS-Only Mode

#96

Post by aaplok »

AntiImperialist wrote: post #65
ffpip wrote: post #54

Earlier quoted context omitted.

Yes, but one less extension with access to all your history, passwords and all other info.

I'm not sure if I trust EFF any less than I trust Mozilla.

I am the same but in this case it is about trusting (EFF and Mozilla) more than Mozilla. You have to trust Mozilla either way.

Re: Firefox 83 introduces HTTPS-Only Mode

#97

Post by acd10j »

iso1631 wrote: post #87
jchw wrote: post #18

I’m surprised at the negative knee-jerk reaction. I actually love this idea immediately. It encapsulates something I kind of already wanted when using HTTPS Everywhere. This doesn’t guarantee the transport is end-to-end secure; I’m sure plenty will strip the encryption at an LB and then possibly send it back over the internet. But, I think it’s a good addition nevertheless. Here’s to hoping for more DoH and encrypted…

I want my OS to do DNS - including DOH, not my browser. I want a single source for my DNS I want my network to tell me a DNS server to use. As I own my computer I can override that, but much of the time I want to use the network provided DNS server.

At least in my case network provided DNS are the worst, Full of spyware, and tracking.

Re: Firefox 83 introduces HTTPS-Only Mode

#98

Post by iso1631 »

antonyh wrote: post #93

I'm for this. Any computer capable of running FF83 is powerful enough to use HTTPS everywhere. What it doesn't do, is force good TLS - there's nothing to stop a site using a weak algorithm, SSLv2/3, or old TLS versions. It also wrecks network-level caching using appliances like Squid.

> What it doesn't do, is force good TLS - there's nothing to stop a site using a weak algorithm, SSLv2/3, or old TLS versions.

TLS 1.0 and 1.1 were disabled in Firefox 78 in June.

Re: Firefox 83 introduces HTTPS-Only Mode

#99

Post by zeepzeep »

iso1631 wrote: post #87
jchw wrote: post #18

I’m surprised at the negative knee-jerk reaction. I actually love this idea immediately. It encapsulates something I kind of already wanted when using HTTPS Everywhere. This doesn’t guarantee the transport is end-to-end secure; I’m sure plenty will strip the encryption at an LB and then possibly send it back over the internet. But, I think it’s a good addition nevertheless. Here’s to hoping for more DoH and encrypted…

I want my OS to do DNS - including DOH, not my browser. I want a single source for my DNS I want my network to tell me a DNS server to use. As I own my computer I can override that, but much of the time I want to use the network provided DNS server.

You'd like Plan 9

Re: Firefox 83 introduces HTTPS-Only Mode

#100

Post by Vinnl »

implying wrote: post #77

This is a great step, but I wish browsers would allow you to set domains that are considered to be secure origins in all cases. I have a decent intranet with transport security guaranteed by VPN, but because it isn't "HTTPS" I can't access tons of browser features.

According to [1] you can disable this for individual sites.

[1] https://news.ycombinator.com/item?id=25121929

Post reply on HN