Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 83 introduces HTTPS-Only Mode

blog.mozilla.org

Post reply on HN
Print view View original

131–140 of 525 posts

Re: Firefox 83 introduces HTTPS-Only Mode

#131

Post by oofoe »

dewey wrote: post #79
jevgeni wrote: post #66

Earlier quoted context omitted.

It obviously is. Having just an HTML site now becomes more expensive for no clear reason. Which makes more sense for people to check out Gemini.

What makes it more expensive? A certificate is free (With LE or self-signed), the performance impact is negligible and there's a clear reason for why everyone should be using it.

It does add a "tax" of sort in the form time or attention that must be paid to keep a website up. You can't just sling some files in a directory and be done -- you have to pay for certificates or pay (in time and executable capability) to keep LetsEncrypt up to date.

And, as wonderful as LetsEncrypt is, it's not forever. At some point, they're gonna' get tired of messing with it or it will get taken over by private equity (see .org) and for whatever reason, it won't work any more.

And sure, that's always been true, new stuff obsoletes old and things fall by the wayside. But my current browser can access modern websites as well as sites from the dawn of the Web. But FireFox 85, 87 or 90 will probably make https mandatory -- and that amazing continuity is gone.

Re: Firefox 83 introduces HTTPS-Only Mode

#132

Post by isbvhodnvemrwvn »

murphy1312 wrote: post #49
kanox wrote: post #24

Earlier quoted context omitted.

HTTPS is not about gatekeeping, you can use "let's encrypt" for free certificates for any domain. HTTPS-only is about forcing all traffic to be encrypted by banning clear-text traffic. I've been using the "HTTPS everywhere" extension for years and it's great.

yes it is. someone has to give you a certificate which the users browser accepts. even if its free today. lets say a simple website which someone uses to display some holiday pictures. why would we need https here, if there is no login or anything like that? it just adds an extra hurdle for not so tech-savvy users and increases the trend to abolish small private websites.

I can MitM that site and add login or arbitrary content.

Re: Firefox 83 introduces HTTPS-Only Mode

#133

Post by 3np »

jchw wrote: post #18

I’m surprised at the negative knee-jerk reaction. I actually love this idea immediately. It encapsulates something I kind of already wanted when using HTTPS Everywhere. This doesn’t guarantee the transport is end-to-end secure; I’m sure plenty will strip the encryption at an LB and then possibly send it back over the internet. But, I think it’s a good addition nevertheless. Here’s to hoping for more DoH and encrypted…

I have mixed feelings about what you wrote.

100% with you that by itself, browser HTTPS-only mode (even by default) is A Good Thing. In isolation, this is a no-brainer and Mozilla's doing the right call.

I'm not happy with DoH though, at all. I fall in the crowd who wants to control my own DNS on my own devices (and I do realize that for those less technically knowledgeable, the status quo is putting that in the hands of the network admin or even ISP, but at least in principle they have the means to do so if they just figure out how, which is relatively trivial). DoH effectively completely cripples things like pihole. I'd have to start whitelisting IPs/hostnames for port 443 :/

Another practical negative consequence is the further centralization of TLS termination in (most notably) Cloudflare and Akamai, as I am sure this will de the default for those who are now rushed to TLS-enable currently uncompliant endpoints. Great sieves for XEyes and private tracking industry.

Re: Firefox 83 introduces HTTPS-Only Mode

#134

Post by Crosseye_Jack »

iso1631 wrote: post #87
jchw wrote: post #18

I’m surprised at the negative knee-jerk reaction. I actually love this idea immediately. It encapsulates something I kind of already wanted when using HTTPS Everywhere. This doesn’t guarantee the transport is end-to-end secure; I’m sure plenty will strip the encryption at an LB and then possibly send it back over the internet. But, I think it’s a good addition nevertheless. Here’s to hoping for more DoH and encrypted…

I want my OS to do DNS - including DOH, not my browser. I want a single source for my DNS I want my network to tell me a DNS server to use. As I own my computer I can override that, but much of the time I want to use the network provided DNS server.

It’s coming...

https://www.bleepingcomputer.com/news/microsoft/how-to-enabl...

Re: Firefox 83 introduces HTTPS-Only Mode

#135

Post by manquer »

iso1631 wrote: post #113
acd10j wrote: post #97

Earlier quoted context omitted.

At least in my case network provided DNS are the worst, Full of spyware, and tracking.

I run my own networks and my own devices, I choose what options go in my DHCP server If I were on a hostile network (say a hotel), then sure, I'll ignore their DNS server and use my own (or indeed just punch my way out via a VPN), but most of the time I use friendly networks, and I don't want to have to configure 20 different applications on a dozen different boxes to use a DNS provider of my choice. There's a reason…

You are able to run own network and have the know how to do so, typical physical Firefox users cannot.

Given your knowledge you can disable or even build firefox with DoH disabled , it is a sensible default for vast majority of users who do not know what DHCP is, or control their network. It cannotis trivial configuration for people who can control and do not want the DoH service provider given by Firefox.

Also many places do not allow VPN traffic either. It is not as easy to bypass monitoring in a locked down environment like typical corporate firewalls, college campuses etc. Yes for every block in place like deep packet inspection etc there is usually some workaround but these become increasingly difficult as more stringent the blocking becomes, and having options like DoH helps users who cannot or do not know how to run VPNs.

Re: Firefox 83 introduces HTTPS-Only Mode

#136

Post by kevincox »

Deukhoofd wrote: post #48
conradludgate wrote: post #30

Earlier quoted context omitted.

According to another comment, you can still allow certain sites through http, so your Internet dev sites are still fine but the global sites will be blocked by default

Sure, but we have like 50 different internal domains for different customers, so that would get annoying real fast ;)

I haven't tried out the release UX yet but if it is just a couple of clicks inline when you fist visit this doesn't sound that bad. I would go though it for the added feeling of privacy and security whenever I am on a public connection.

Re: Firefox 83 introduces HTTPS-Only Mode

#137

Post by jaas »

dusted wrote: post #60
m_eiman wrote: post #53

It's obvious I need to spend more time researching Gemini and similar things. The "web" is going to be a true monoculture very, very soon.

I agree. HTTPS is great, at definitely needed for a lot of things. But I don't need my cat pictures encrypted, I don't need lots of things encrypted, and frankly, I don't want it to be encrypted when it's not required, it's a waste of resources, both processing and network. Then there is the case of all the old computers that either lack the processing power or support for modern algorithms.

If a page doesn't use HTTPS, even if it is cats, you cannot trust that the traffic has not been modified in transit. You try to load a cat but a network attacker can add malware or mining code or a worse exploit.

Every page needs HTTPS because you can't trust any content sent to you over HTTP. You don't know if it's "just a cat picture."

Re: Firefox 83 introduces HTTPS-Only Mode

#138

Post by afiori »

globular-toast wrote: post #91

There's a phenomenon I observe quite regularly in tech. A problem exists and creative people develop an innovative solution to said problem. The solution then becomes popular and a singular goal of uncreative people who deploy said solution everywhere and push it to its logical extreme. I remember seeing this in the mid-2000s when HTML tables were shunned in favour of "divs". I saw people reinventing tables using div…

> Am I supposed to trust them more than some man-in-the-middle just because they own a domain name?

The green padlock will not turn any unreliable fake news site of your choise in a trustworthy outlet but it does make some guarantees about it being the same site as yesterday (barring security leaks or missed DNS renewal)

AFAIU the elefant in the room is that if your DNS resolver is malicious and points all domains to a malicious IP then https is completely useless.

Re: Firefox 83 introduces HTTPS-Only Mode

#140

Post by mrslave »

jchw wrote: post #18

I’m surprised at the negative knee-jerk reaction. I actually love this idea immediately. It encapsulates something I kind of already wanted when using HTTPS Everywhere. This doesn’t guarantee the transport is end-to-end secure; I’m sure plenty will strip the encryption at an LB and then possibly send it back over the internet. But, I think it’s a good addition nevertheless. Here’s to hoping for more DoH and encrypted…

Agreed. I've been using this for several versions already (mentioned by other commenters - dom.security.https_only_mode). Very few websites break, and they should know better (e.g. HTTPS redirects to HTTP, redirects to another HTTPS location).

I've often daydreamed of a new HN freature where non-HTTPS links have a preceeding red marker "[HTTP only]" (or similar) but never could find the correct place to write it down. Considering that Firefox is now a minority browser :( perhaps there is still usefulness in this idea?

Post reply on HN