The Firefox versioning numbers are lost on me.
I have no idea of the importance between 83 vs 80.
Firefox 83 introduces HTTPS-Only Mode
201–210 of 525 posts
Re: Firefox 83 introduces HTTPS-Only Mode
#202Earlier quoted context omitted.
If only the OS could terminate TLS and allow to filter decrypted traffic locally.
I was thinking more of devices I don't control - IOT stuff that requires internet access to function (like a box to watch netflix). Clearly anything running on my machine is fine as it's under my control
So between the user and the network operator, who should have the final say? It seems like you're saying, "it should be the user when I'm the user and it should be the network operator when I'm the network operator". But I don't think we can have it both ways.
Re: Firefox 83 introduces HTTPS-Only Mode
#203Earlier quoted context omitted.
I want my OS to do DNS - including DOH, not my browser. I want a single source for my DNS I want my network to tell me a DNS server to use. As I own my computer I can override that, but much of the time I want to use the network provided DNS server.
> I want my OS to do DNS - including DOH, not my browser. The cat is out the bag, so to speak. I foresee a lot of adware, spyware, and malware leveraging DoH now to evade just about every DNS-based monitoring/blocking/provisioning solutions. Anyway, the right layer to monitor for Internet traffic has always been the IP layer (VPNs notwithstanding).
This has always felt like a strange concern to me. It’s a bit like refusing to have gloves in your house, so that a burglar can’t borrow your gloves to avoid leaving fingerprints.
Adware, spyware, and malware has always had the ability to avoid system DNS. At its most basic, they could hardcode lists of IPs into their malicious code. At its most complex, the same building blocks that DoH/DoT use were available to them: they could build similar tools that tunnel over HTTPS/SSH/etc, whichever protocol they felt was least conspicuous on their target system. Drop a list of hostnames into a pastebin post, tell your malware to check the list for updates, profit.
DoH in Firefox simply makes the above issue harder to ignore. Before this, an enterprise or individual sysadmin could implement DNS inspection at the border, see logs showing their users browsing naughty websites, and feel like they’d made progress. But they’d always be blind to attackers (or nefarious users) who just didn’t bother using the stock DNS offering to bootstrap their hijinks. Detecting that has always required device-level monitoring or further MITM of traffic; learning about DoH makes that more obvious to sysadmins, but it doesn’t materially change what adversaries were able to do already.
Re: Firefox 83 introduces HTTPS-Only Mode
#204HTTPS is brittle. HTTP is insecure, but will run forever. This move will literally kill the old web.
I would hope you could expand on this a bit?
Re: Firefox 83 introduces HTTPS-Only Mode
#205The Firefox versioning numbers are lost on me. I have no idea of the importance between 83 vs 80.
83 - 80 = 3
Therefore version 83 is 3 versions ahead of version 80. Note that "version" in this context is shorthand for "major version". It does not include minor patches that only fix a bug or security issue.
Each new major version of Firefox comes with new features and may occasionally deprecate or remove old features. They are currently released roughly every 4 weeks.
Re: Firefox 83 introduces HTTPS-Only Mode
#206Earlier quoted context omitted.
Using https is making the web a monoculture?
It's part of the culture of making everything web terribly complicated, which has resulted in the death of all but three web browsers. It's now practically impossible to write a new web browser from scratch, unless you're a mega corp with endless resources and a grudge against Google, and they're still adding more complexity every day.
The web started out as a very optimistic project with no security and a lot based on trust. As it evolved a lot of security had to be bolted on which now makes it a bit more complicated than in the early days. But what's the alternative?
Of course a perfect protocol where nothing needs to be added later would be great, but that's not very realistic.
Re: Firefox 83 introduces HTTPS-Only Mode
#207Earlier quoted context omitted.
I was thinking more of devices I don't control - IOT stuff that requires internet access to function (like a box to watch netflix). Clearly anything running on my machine is fine as it's under my control
So between the user and the network operator, who should have the final say? It seems like you're saying, "it should be the user when I'm the user and it should be the network operator when I'm the network operator". But I don't think we can have it both ways.
Generally the policy should be
1) The ISP says what should be used
2) the lan either accepts that, or the operator puts their own values
3) the device either accepts that, or the operator puts their own values
Same as object inheritence. An ISP says "use this DNS server it's nearer", the network operator says "no thanks, I'll run my own with an upstream of google as I don't like your NXDOMAIN injects", the user says "actually I'll use cloudflare because I don't trust any of you"
That's all fine, and gives the power to the user.
Exceptionally if a device doesn't allow the network settings to be overwritten for some technical reason, it should simply accept what the lan sends it.
Re: Firefox 83 introduces HTTPS-Only Mode
#208Earlier quoted context omitted.
If only the OS could terminate TLS and allow to filter decrypted traffic locally.
Isn't this SSL offloading and done by companies to introspect the traffic?
That only works as long as the CA trusted by the user's computer is controlled by the box trying to do this.
Re: Firefox 83 introduces HTTPS-Only Mode
#209I’m surprised at the negative knee-jerk reaction. I actually love this idea immediately. It encapsulates something I kind of already wanted when using HTTPS Everywhere. This doesn’t guarantee the transport is end-to-end secure; I’m sure plenty will strip the encryption at an LB and then possibly send it back over the internet. But, I think it’s a good addition nevertheless. Here’s to hoping for more DoH and encrypted…
I want my OS to do DNS - including DOH, not my browser. I want a single source for my DNS I want my network to tell me a DNS server to use. As I own my computer I can override that, but much of the time I want to use the network provided DNS server.
Easily doable (at least for the browser): https://support.mozilla.org/en-US/kb/canary-domain-use-appli...
Re: Firefox 83 introduces HTTPS-Only Mode
#210In case you are wondering what are the biggest websites that don’t do https by default: https://whynohttps.com/
> Data last updated on 11 Jan 2020 at 23:51 UTC
I wonder if that will get an update next January. I'd also be more interested in a list of popular sites that don't support HTTPS at all, i.e. the sites that will trigger a warning prompt under this new HTTPS-Only Mode.