Firefox 83 introduces HTTPS-Only Mode • Hacker News Board

Re: Firefox 83 introduces HTTPS-Only Mode

#211

Post by jevgeni » Tue, Nov 17, 2020, 1:53 PM UTC

MaxBarraclough wrote: post #146

oofoe wrote: post #131

Earlier quoted context omitted.

It does add a "tax" of sort in the form time or attention that must be paid to keep a website up. You can't just sling some files in a directory and be done -- you have to pay for certificates or pay (in time and executable capability) to keep LetsEncrypt up to date. And, as wonderful as LetsEncrypt is, it's not forever. At some point, they're gonna' get tired of messing with it or it will get taken over by private e…

There are good reasons to insist on the use of HTTPS for all sites on the public web, with no exceptions or excuses. This topic has cropped up before: • https://news.ycombinator.com/item?id=21912817 • https://news.ycombinator.com/item?id=24640183 • https://news.ycombinator.com/item?id=22147858

These links list literally SOME and not ALL cases that need encryption.

Re: Firefox 83 introduces HTTPS-Only Mode

#212

Post by judge2020 » Tue, Nov 17, 2020, 1:54 PM UTC

iso1631 wrote: post #162

manquer wrote: post #135

Earlier quoted context omitted.

You are able to run own network and have the know how to do so, typical physical Firefox users cannot. Given your knowledge you can disable or even build firefox with DoH disabled , it is a sensible default for vast majority of users who do not know what DHCP is, or control their network. It cannotis trivial configuration for people who can control and do not want the DoH service provider given by Firefox. Also many…

If your network allows TLS to an arbitary DOH server it allows VPN over TLS to an arbitrary server

A lot of networks block VPNs via port number + DPI, but can't really block DNS over HTTPS if it looks like a connection to any other HTTPS website.

Re: Firefox 83 introduces HTTPS-Only Mode

#213

Post by shawnz » Tue, Nov 17, 2020, 1:54 PM UTC

iso1631 wrote: post #195

franga2000 wrote: post #190

Earlier quoted context omitted.

This is nothing that wasn't possible before. Taking the traditional example of hosts-blocking the Adobe activation servers, what was stopping them from just querying 1.1.1.1 from the app? Or even falling back on a hard-coded IP? Especially with IPv6, bypassing DNS-based blocks is rather trivial - the main reson we don't see it all that much is that companies simply don't care to do it. Users of PiHole and similar are…

You're right, I guess the question is did they bother before. If normal DNS works fine for 95% of users, the hurdle of implementing a non-standard workaround is too much. If DOH is the norm, then the hurdle becomes lower. Of course you can just drop a rule blocking the IP address on your firewall, which will probably work for a while.

I would argue that the hurdle of bypassing DNS-based content blocking was already so vanishingly small that it doesn't make any sense to impede useful and practical privacy technologies on that basis.

You could make the exact same kind of argument about widespread use of HTTPS for example. Do we want to allow encryption technology if it means the enemy can use it too? As a society we have agreed that encryption is a net positive even though terrorists and criminals benefit from it, but when malware uses it then that's too far?

Re: Firefox 83 introduces HTTPS-Only Mode

#214

Post by cat199 » Tue, Nov 17, 2020, 1:54 PM UTC

new23d wrote: post #44

jchw wrote: post #18

I’m surprised at the negative knee-jerk reaction. I actually love this idea immediately. It encapsulates something I kind of already wanted when using HTTPS Everywhere. This doesn’t guarantee the transport is end-to-end secure; I’m sure plenty will strip the encryption at an LB and then possibly send it back over the internet. But, I think it’s a good addition nevertheless. Here’s to hoping for more DoH and encrypted…

Fully support this argument and Mozilla's initiative. I work for a firewall co and we had taken a strategic decision to not allow plaintext traffic onto the internet (from cloud deployments). It's just lazy on the client or server operator's part to not have it so.

this breaks caching of simple objects that do not require content security

Re: Firefox 83 introduces HTTPS-Only Mode

#215

Post by jevgeni » Tue, Nov 17, 2020, 1:55 PM UTC

ezequiel-garzon wrote: post #117

jevgeni wrote: post #56

Earlier quoted context omitted.

Which means any pure HTML resources would either have to rely on let’s encrypt or pony up some certificate money. So basically a death knell for homepages.

Why does relying on Let’s Encrypt entail the death knell for homepages? I respect the whole gatekeeping argument, but homepages will still be around.

Because relying only a single entity sponsored by corporations to protect people from corporate gatekeeping seems like a dumb idea in the long run.

Re: Firefox 83 introduces HTTPS-Only Mode

#216

Post by cat199 » Tue, Nov 17, 2020, 1:55 PM UTC

jorl17 wrote: post #188

Jaruzel wrote: post #118

awww crap - I've got loads of low-traffic websites that don't need https[1] that I'm now going to have to spend time sorting out certificates for. To be honest, it's about time that cert enablement is built into all web server configs (on all OSs) as a native feature instead of having to manually roll the config using this-weeks-currently-preferred letsencrypt script. --- [1] Yes, yes, I know everyone on HN prefers e…

The main problem with keeping sites http is that someone in the middle can modify the content and inject arbitrary code, be it ads, crypto mining or just a redirect to a worse website. Therefore I believe it should be a social duty to make everything https so as to ensure that we don’t create something that can be used to harm others. I didn’t use to think like this until I actually tried it out by going to a mall an…

there is a middle ground of authenticating traffic without encrypting it - c.f. IPSEC AH mode - granted this type of thing isn't in HTTP but easily could be

Re: Firefox 83 introduces HTTPS-Only Mode

#217

Post by m4lvin » Tue, Nov 17, 2020, 1:56 PM UTC

autoexec wrote: post #78

m4lvin wrote: post #69

Earlier quoted context omitted.

Thanks for mentioning this! This about:config flag is also available in Firefox ESR 78 already (but there is no GUI for it yet).

Are there about:config entries to handle excluded sites?

It seems no / I could not find any.

Re: Firefox 83 introduces HTTPS-Only Mode

#218

Post by newscracker » Tue, Nov 17, 2020, 1:56 PM UTC

> In summary, HTTPS-Only Mode is the future of web browsing!

It has certainly seemed like HTTPS is the future of the web for the last few years. I love this HTTPS-Only mode and wish it would become the default (with better downgrades and messages for users who may not understand what it means). With the number of HTTP-only sites dwindling, this could result in a faster experience for sites that do not want to (or haven’t figured out how to) use HSTS or HSTS Preload (no redirects from HTTP to HTTPS) and for users who haven’t heard of the HTTPS Everywhere [1] extension.

[1]: https://www.eff.org/https-everywhere

Re: Firefox 83 introduces HTTPS-Only Mode

#219

Post by jevgeni » Tue, Nov 17, 2020, 1:57 PM UTC

dalu wrote: post #74

jevgeni wrote: post #56

Earlier quoted context omitted.

Which means any pure HTML resources would either have to rely on let’s encrypt or pony up some certificate money. So basically a death knell for homepages.

especially if the diplayed warning looks like a "ThIs Is An InSeCuRe SiTe" warning. self signed cert? WaRnInG!!!111eleven no https? WaRnInG!!!111eleven cert expired 2 hours ago? WaRnInG!!!111eleven

It amazes me that the HN crowd tear Microsoft to shreds for embrace-extend-extinguish, and then turn on their heels to cheer on crap like this without a second thought.

Re: Firefox 83 introduces HTTPS-Only Mode

#220

Post by doublerabbit » Tue, Nov 17, 2020, 1:57 PM UTC

jorl17 wrote: post #188

Jaruzel wrote: post #118

awww crap - I've got loads of low-traffic websites that don't need https[1] that I'm now going to have to spend time sorting out certificates for. To be honest, it's about time that cert enablement is built into all web server configs (on all OSs) as a native feature instead of having to manually roll the config using this-weeks-currently-preferred letsencrypt script. --- [1] Yes, yes, I know everyone on HN prefers e…

The main problem with keeping sites http is that someone in the middle can modify the content and inject arbitrary code, be it ads, crypto mining or just a redirect to a worse website. Therefore I believe it should be a social duty to make everything https so as to ensure that we don’t create something that can be used to harm others. I didn’t use to think like this until I actually tried it out by going to a mall an…

> The main problem with keeping sites http is that someone in the middle can modify the content and inject arbitrary code

I keep hearing this as a plausible excuse, yet I've never seen any proof of such.

non-https does make it possible but has anyone got any source where someone has been victim of such attacks?