Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 83 introduces HTTPS-Only Mode

blog.mozilla.org

Post reply on HN
Print view View original

181–190 of 525 posts

Re: Firefox 83 introduces HTTPS-Only Mode

#181

Post by crazypython »

wccrawford wrote: post #172
crazypython wrote: post #169

Not every web service is easy to set up with HTTPS as a simple Let's Encrypt service. Take a game. It dynamically balances between servers rented and destroyed on the fly. It needs a wildcard DNS certificate. Then all the sub-servers need to have that wildcard certificate. In conclusion, deprecating HTTP makes it harder for people to get started on the web. How are you going to get certificates for IP address' contro…

A game absolutely should be use HTTPS anyhow, for their own security. But I'd say that anyone that has an operation so big that it dynamically creates and destroys servers to balance load should probably already be paying for their own wildcard cert anyhow.

> A game absolutely should be use HTTPS anyhow, for their own security.

The game has no log-in or sign-up; no account system. The only potentially sensitive data sent is the nickname the user enters.

> But I'd say that anyone that has an operation so big that it dynamically creates and destroys servers to balance load should probably already be paying for their own wildcard cert anyhow.

The game is free and ad-supported. Dynamically creating and destroying servers is a basic requirement.

Re: Firefox 83 introduces HTTPS-Only Mode

#182

Post by saalweachter »

abdullahkhalids wrote: post #153
dusted wrote: post #60

Earlier quoted context omitted.

I agree. HTTPS is great, at definitely needed for a lot of things. But I don't need my cat pictures encrypted, I don't need lots of things encrypted, and frankly, I don't want it to be encrypted when it's not required, it's a waste of resources, both processing and network. Then there is the case of all the old computers that either lack the processing power or support for modern algorithms.

You don't need your cat pictures encrypted per se, but you do want to ensure that your Webportal cannot MITM your communications with catpictures.com and inject malicious javascript into the webpage.

In an adversarial situation, you also want your opponent to spend time and resources storing or cracking gigabytes of cat pictures for every kilobyte of email they get.

Re: Firefox 83 introduces HTTPS-Only Mode

#183

Post by saurik »

nine_k wrote: post #170
iso1631 wrote: post #160

Earlier quoted context omitted.

I've always assumed any device or program I don't control will bypass anything I tell it to use and tunnel all it's evil traffic. It does feel the world is moving away from a multi-level network to run everything over TLS/TCP (and probably eventually mainly TLS/UDP), taking away the power from me as a network and device owner, and giving it to the developers

If only the OS could terminate TLS and allow to filter decrypted traffic locally.

This is prevented by certificate pinning.

Re: Firefox 83 introduces HTTPS-Only Mode

#184

Post by m_eiman »

dewey wrote: post #59
m_eiman wrote: post #53

It's obvious I need to spend more time researching Gemini and similar things. The "web" is going to be a true monoculture very, very soon.

Using https is making the web a monoculture?

It's part of the culture of making everything web terribly complicated, which has resulted in the death of all but three web browsers.

It's now practically impossible to write a new web browser from scratch, unless you're a mega corp with endless resources and a grudge against Google, and they're still adding more complexity every day.

Re: Firefox 83 introduces HTTPS-Only Mode

#185

Post by jchw »

raxxorrax wrote: post #121
jchw wrote: post #18

I’m surprised at the negative knee-jerk reaction. I actually love this idea immediately. It encapsulates something I kind of already wanted when using HTTPS Everywhere. This doesn’t guarantee the transport is end-to-end secure; I’m sure plenty will strip the encryption at an LB and then possibly send it back over the internet. But, I think it’s a good addition nevertheless. Here’s to hoping for more DoH and encrypted…

I just hope we don't get compromised CA because a lot of governments currently try to fight encryption. But agreed, it is a good idea. The only disadvantage I see is that some sites might not want to pay for a certificate and don't know how to easily obtain free ones. So it might kill some sites.

Not 100% sure why this is being downvoted, I think it is true that some sites, for one reason or another, probably will not adopt ACME/Let's Encrypt...

Re: Firefox 83 introduces HTTPS-Only Mode

#186

Post by pmontra »

BostonEnginerd wrote: post #159
EastSmith wrote: post #155

Earlier quoted context omitted.

Can you elaborate? An adware app will be installed in the OS, and will proxy all DNS requests?

Apps will make DOH requests from within their apps to avoid host-based DNS blocking.

The next step is blocking all the traffic from all apps and whitelist the IP addresses app by app. I did it on my Android phone, a couple of phones ago. I don't remember the name of the app. It could be done on a desktop or server OS too.

Re: Firefox 83 introduces HTTPS-Only Mode

#187

Post by imtringued »

As long as there is an escape hatch this is great. I absolutely loathe having to setup http to https redirects because it means the first visit for many users is completely unsecured. HSTS preloading is a hack. Why not just connect to https first?

Re: Firefox 83 introduces HTTPS-Only Mode

#188

Post by jorl17 »

Jaruzel wrote: post #118

awww crap - I've got loads of low-traffic websites that don't need https[1] that I'm now going to have to spend time sorting out certificates for. To be honest, it's about time that cert enablement is built into all web server configs (on all OSs) as a native feature instead of having to manually roll the config using this-weeks-currently-preferred letsencrypt script. --- [1] Yes, yes, I know everyone on HN prefers e…

The main problem with keeping sites http is that someone in the middle can modify the content and inject arbitrary code, be it ads, crypto mining or just a redirect to a worse website.

Therefore I believe it should be a social duty to make everything https so as to ensure that we don’t create something that can be used to harm others.

I didn’t use to think like this until I actually tried it out by going to a mall and doing it myself. Whoever was accessing simple http websites for the very short end of a stick (metaphorically speaking)

Re: Firefox 83 introduces HTTPS-Only Mode

#189

Post by 3np »

kd913 wrote: post #161
3np wrote: post #133

Earlier quoted context omitted.

I have mixed feelings about what you wrote. 100% with you that by itself, browser HTTPS-only mode (even by default) is A Good Thing. In isolation, this is a no-brainer and Mozilla's doing the right call. I'm not happy with DoH though, at all. I fall in the crowd who wants to control my own DNS on my own devices (and I do realize that for those less technically knowledgeable, the status quo is putting that in the hand…

Firefox DoH easily works with DNSCryptProxy. https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Local-DoH You can easily set it up to contact that, but enable some exclusions for specific domains if you wish to fallback to pihole. It's probably not that efficient anyway to be using pihole's filtering in Firefox compared with just ublock origin anyway.

I wasn't aware of this part of dnscrypt-proxy, thanks for sharing. I find network-level blocking and browser extensions work complementary.

In a broader sense, I guess the larger concerns is malware and trackware on various devices where DoH is used maliciously. Especially smartphones. Granted there is nothing stopping them today, but the normalization of DoH will put it in arms reach for everyone.

Re: Firefox 83 introduces HTTPS-Only Mode

#190

Post by franga2000 »

BostonEnginerd wrote: post #159
EastSmith wrote: post #155

Earlier quoted context omitted.

Can you elaborate? An adware app will be installed in the OS, and will proxy all DNS requests?

Apps will make DOH requests from within their apps to avoid host-based DNS blocking.

This is nothing that wasn't possible before. Taking the traditional example of hosts-blocking the Adobe activation servers, what was stopping them from just querying 1.1.1.1 from the app? Or even falling back on a hard-coded IP? Especially with IPv6, bypassing DNS-based blocks is rather trivial - the main reson we don't see it all that much is that companies simply don't care to do it. Users of PiHole and similar are usually the kinds of users who will figure out a way to block whatever they want one way or another, so there's no use in trying to stop them. Until we get hardware-enforced app signing (big middle finger to Apple here) we can block anything, regardless of DoH.
Post reply on HN