Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 83 introduces HTTPS-Only Mode

blog.mozilla.org

Post reply on HN
Print view View original

191–200 of 525 posts

Re: Firefox 83 introduces HTTPS-Only Mode

#191

Post by m_eiman »

autoexec wrote: post #84
dusted wrote: post #60

Earlier quoted context omitted.

I agree. HTTPS is great, at definitely needed for a lot of things. But I don't need my cat pictures encrypted, I don't need lots of things encrypted, and frankly, I don't want it to be encrypted when it's not required, it's a waste of resources, both processing and network. Then there is the case of all the old computers that either lack the processing power or support for modern algorithms.

I'd be more receptive to this if ISPs weren't snooping on traffic and selling their customer's browsing history. As long as we have to operate under the assumption that every scrap of data we send or request will be picked apart and used against us whenever possible I'd rather encrypt everything and have a little less to worry about.

Perhaps you should get some better laws in your country to prevent this, instead of ruining the web for the rest of the world?

Re: Firefox 83 introduces HTTPS-Only Mode

#192

Post by peterwwillis »

A long time ago I suggested a new uri prefix - "secure://" - that would be a synonym for "HTTPS-only". If you visit a secure:// link, every single page load in the session would require strong encryption, secure cookies, etc.

The idea was to allow http if needed, and alternately allow strict https if needed, in a backwards compatible way (visiting a https:// url would work as before, but visiting secure:// would trigger the strict security for the rest of the session). This way you have the best of both worlds and the user (and server) get choice/agency.

The purpose was to stop MITM. The ability to MITM only requires blocking port 443 and letting the browser fall back to 80; this works even against HSTS because most people will just try other URLs until one works. So you need a way to avoid MITM at least for some specific requests. Banks, e-mail providers, etc would say "type in secure://mybank.com in your browser for strong security".

Another option was a "secure only" button on the browser. It seems they're moving towards this. They've buried it in preferences, which hopefully they'll change to the front UI. But I still think the secure:// links are easier for laypeople.

Re: Firefox 83 introduces HTTPS-Only Mode

#193

Post by swiley »

ignoramous wrote: post #151
iso1631 wrote: post #87

Earlier quoted context omitted.

I want my OS to do DNS - including DOH, not my browser. I want a single source for my DNS I want my network to tell me a DNS server to use. As I own my computer I can override that, but much of the time I want to use the network provided DNS server.

> I want my OS to do DNS - including DOH, not my browser. The cat is out the bag, so to speak. I foresee a lot of adware, spyware, and malware leveraging DoH now to evade just about every DNS-based monitoring/blocking/provisioning solutions. Anyway, the right layer to monitor for Internet traffic has always been the IP layer (VPNs notwithstanding).

If we're going to talk about the "right" thing to do then don't run closed software or anything that doesn't do what you want and the problem goes away.

Re: Firefox 83 introduces HTTPS-Only Mode

#194

Post by iso1631 »

nine_k wrote: post #170
iso1631 wrote: post #160

Earlier quoted context omitted.

I've always assumed any device or program I don't control will bypass anything I tell it to use and tunnel all it's evil traffic. It does feel the world is moving away from a multi-level network to run everything over TLS/TCP (and probably eventually mainly TLS/UDP), taking away the power from me as a network and device owner, and giving it to the developers

If only the OS could terminate TLS and allow to filter decrypted traffic locally.

I was thinking more of devices I don't control - IOT stuff that requires internet access to function (like a box to watch netflix). Clearly anything running on my machine is fine as it's under my control

Re: Firefox 83 introduces HTTPS-Only Mode

#195

Post by iso1631 »

franga2000 wrote: post #190
BostonEnginerd wrote: post #159

Earlier quoted context omitted.

Apps will make DOH requests from within their apps to avoid host-based DNS blocking.

This is nothing that wasn't possible before. Taking the traditional example of hosts-blocking the Adobe activation servers, what was stopping them from just querying 1.1.1.1 from the app? Or even falling back on a hard-coded IP? Especially with IPv6, bypassing DNS-based blocks is rather trivial - the main reson we don't see it all that much is that companies simply don't care to do it. Users of PiHole and similar are…

You're right, I guess the question is did they bother before. If normal DNS works fine for 95% of users, the hurdle of implementing a non-standard workaround is too much. If DOH is the norm, then the hurdle becomes lower.

Of course you can just drop a rule blocking the IP address on your firewall, which will probably work for a while.

Re: Firefox 83 introduces HTTPS-Only Mode

#197

Post by imtringued »

crazypython wrote: post #169

Not every web service is easy to set up with HTTPS as a simple Let's Encrypt service. Take a game. It dynamically balances between servers rented and destroyed on the fly. It needs a wildcard DNS certificate. Then all the sub-servers need to have that wildcard certificate. In conclusion, deprecating HTTP makes it harder for people to get started on the web. How are you going to get certificates for IP address' contro…

>It needs a wildcard DNS certificate. Then all the sub-servers need to have that wildcard certificate.

Just give each server a separate domain and certificate as you create them. The matchmaking algorithm returns a url pointing to the server.

>How are you going to get certificates for IP address' control dashboard, after all?

By clicking the damn button?

Re: Firefox 83 introduces HTTPS-Only Mode

#198

Post by conradfr »

crazypython wrote: post #169

Not every web service is easy to set up with HTTPS as a simple Let's Encrypt service. Take a game. It dynamically balances between servers rented and destroyed on the fly. It needs a wildcard DNS certificate. Then all the sub-servers need to have that wildcard certificate. In conclusion, deprecating HTTP makes it harder for people to get started on the web. How are you going to get certificates for IP address' contro…

Similarly I got stung by Chrome recently.

I have a side project that plays webradio streams. A lot of them don't have https, some links even are ip addresses and Chrome won't allow to request them on my https site. In the end it forced me to create a stream proxy that I have to host...

Re: Firefox 83 introduces HTTPS-Only Mode

#199

Post by shawnz »

2ion wrote: post #163
ignoramous wrote: post #151

Earlier quoted context omitted.

> I want my OS to do DNS - including DOH, not my browser. The cat is out the bag, so to speak. I foresee a lot of adware, spyware, and malware leveraging DoH now to evade just about every DNS-based monitoring/blocking/provisioning solutions. Anyway, the right layer to monitor for Internet traffic has always been the IP layer (VPNs notwithstanding).

> The cat is out the bag, so to speak. I foresee a lot of adware, spyware, and malware leveraging DoH now to evade just about every DNS-based monitoring/blocking/provisioning solutions. But tunnelling X in Y is not new at all and has a long tradition (even in regular protocol design). Is this really a shift waiting to happen in malware? As I would think, this has been available all along. Except for browser-based mal…

Right. It is ridiculous to say that DoH enables malware because it has always been trivial to bypass DNS-based access control with or without technologies like DoH. In fact, if anything, using DoH would be a particularly cumbersome way of doing it when there are many simpler solutions. Like for example, just putting an IP in a text file on a REST endpoint.

Re: Firefox 83 introduces HTTPS-Only Mode

#200

Post by [deleted] »

Jaruzel wrote: post #118

awww crap - I've got loads of low-traffic websites that don't need https[1] that I'm now going to have to spend time sorting out certificates for. To be honest, it's about time that cert enablement is built into all web server configs (on all OSs) as a native feature instead of having to manually roll the config using this-weeks-currently-preferred letsencrypt script. --- [1] Yes, yes, I know everyone on HN prefers e…

[deleted]
Post reply on HN