Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 83 introduces HTTPS-Only Mode

blog.mozilla.org

Post reply on HN
Print view View original

171–180 of 525 posts

Re: Firefox 83 introduces HTTPS-Only Mode

#171

Post by livre »

amenod wrote: post #156
acd10j wrote: post #97

Earlier quoted context omitted.

At least in my case network provided DNS are the worst, Full of spyware, and tracking.

How can DNS be "full of spyware"? Or are you saying that it is used for spying on you? But anyway, it is your decision to use them - you can use 1.1.1.1 (CloudFlare), 8.8.8.8 (Google - if you don't mind the tracking) or any other DNS provider.

I don't know what GP meant with "full of spyware" but the most popular ISP in my region (Telefónica) used to redirect to pages filled with ads when a domain couldn't be resolved. Changing to 8.8.8.8 wouldn't work because it was unencrypted, they intercepted the requests and still redirected to ads. They stopped doing it some time ago but any ISP or middle man has the ability to continue doing that if they want.

Re: Firefox 83 introduces HTTPS-Only Mode

#172

Post by wccrawford »

crazypython wrote: post #169

Not every web service is easy to set up with HTTPS as a simple Let's Encrypt service. Take a game. It dynamically balances between servers rented and destroyed on the fly. It needs a wildcard DNS certificate. Then all the sub-servers need to have that wildcard certificate. In conclusion, deprecating HTTP makes it harder for people to get started on the web. How are you going to get certificates for IP address' contro…

A game absolutely should be use HTTPS anyhow, for their own security.

But I'd say that anyone that has an operation so big that it dynamically creates and destroys servers to balance load should probably already be paying for their own wildcard cert anyhow.

Re: Firefox 83 introduces HTTPS-Only Mode

#173

Post by acdha »

zajio1am wrote: post #158

Hot take: HTTPS-only mode is a bad idea if it is not paired with first-class support for self-signed certificates authorized using DANE+DNSSec. It just forces everyone to use broken/redundant CA model.

Can you articulate precisely the problem you believe this will solve? From my perspective it seems like it’s just making the system more fragile and harder to fix since DNSSEC requires OS updates to improve, while not meaningfully preventing state-level attacks.

Re: Firefox 83 introduces HTTPS-Only Mode

#174

Post by dingaling »

hsbauauvhabzb wrote: post #72
murphy1312 wrote: post #49

Earlier quoted context omitted.

yes it is. someone has to give you a certificate which the users browser accepts. even if its free today. lets say a simple website which someone uses to display some holiday pictures. why would we need https here, if there is no login or anything like that? it just adds an extra hurdle for not so tech-savvy users and increases the trend to abolish small private websites.

If my choices are to implement a security control which forces a layer of security, or forgo that security control so Alice can upload her Holiday pictures to a host which doesn’t support HTTPS either, I know which one I’ll pick. Alice should either host her photos on Instagram, or learn how to run letsencrypt. The day where certs are no longer freely obtainable is the day another self governed free TLS provider will…

> Alice should either host her photos on Instagram, or learn how to run letsencrypt.

Both leading to further centralisation of the Internet.

> by providing installers to inject CAs into system cert stores

That's already pointless on Android, user-installed CAs are ignored by default unless an app developer opts in to using them.

Once we go down this path there's no turning back to the user-centric Web of the 1990s / 2000s

Re: Firefox 83 introduces HTTPS-Only Mode

#175

Post by app4soft »

Actually I'm using 3 browsers on my Linux PC:

- Links2 (in graphics mode) — main, for fully no-JS browsing;

- Pale Moon* (in Private mode) — main, for browsing w/ & w/o JS;

- Firefox — for curious reasons if target website is not working in Links2 & Pale Moon.

In last year I used Firefox maybe twice, as Links2 & Pale Moon.

As for Android mobile:

- Termux app + Links2 (in non-graphics mode) — main for fully no-JS browsing;

- Prvacy Browser — main, for browsing w/ & w/o JS;

- DuckDuckGo Browser — for curious reasons if target website is not working in Termux/Links2 & Privacy Browser.

P.S. In conclusion, happy to see Firefox is still growing, but every release just brings many "hardcoded" features that, as for me, should not be "hardcoded" in free & open-source browser.

Re: Firefox 83 introduces HTTPS-Only Mode

#176

Post by jhoechtl »

nine_k wrote: post #170
iso1631 wrote: post #160

Earlier quoted context omitted.

I've always assumed any device or program I don't control will bypass anything I tell it to use and tunnel all it's evil traffic. It does feel the world is moving away from a multi-level network to run everything over TLS/TCP (and probably eventually mainly TLS/UDP), taking away the power from me as a network and device owner, and giving it to the developers

If only the OS could terminate TLS and allow to filter decrypted traffic locally.

Isn't this SSL offloading and done by companies to introspect the traffic?

Re: Firefox 83 introduces HTTPS-Only Mode

#177

Post by livre »

Cthulhu_ wrote: post #82
pjc50 wrote: post #45

Earlier quoted context omitted.

DoH changes who gets all your DNS traffic from your ISP and your router to (in practice) a single central DoH provider. Which of those you trust least depends on who you are.

Can a user use multiple (fallback) DNS-over-HTTPS providers? Do the DoH providers supply fallbacks (which iirc most DNS providers do)?

Depends on the client. Firefox doesn't support a fallback and tries unencrypted or fails depending on how you configured it. AdGuard Home can use fallbacks so you can run a local instance and point Firefox there. Some providers supply fallbacks (https://1.1.1.1/dns-query and https://1.0.0.1/dns-query for example).

Re: Firefox 83 introduces HTTPS-Only Mode

#180

Post by lxgr »

Jaruzel wrote: post #118

awww crap - I've got loads of low-traffic websites that don't need https[1] that I'm now going to have to spend time sorting out certificates for. To be honest, it's about time that cert enablement is built into all web server configs (on all OSs) as a native feature instead of having to manually roll the config using this-weeks-currently-preferred letsencrypt script. --- [1] Yes, yes, I know everyone on HN prefers e…

> about time that cert enablement is built into all web server configs

It feels like we're slowly getting there! +1 for Caddy for making HTTPS a surprisingly pleasant process. My home router and NAS also support (and enable) Letsencrypt out of the box, which was a nice surprise.

Post reply on HN