Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 83 introduces HTTPS-Only Mode

blog.mozilla.org

Post reply on HN
Print view View original

221–230 of 525 posts

Re: Firefox 83 introduces HTTPS-Only Mode

#221

Post by jevgeni »

dewey wrote: post #79
jevgeni wrote: post #66

Earlier quoted context omitted.

It obviously is. Having just an HTML site now becomes more expensive for no clear reason. Which makes more sense for people to check out Gemini.

What makes it more expensive? A certificate is free (With LE or self-signed), the performance impact is negligible and there's a clear reason for why everyone should be using it.

You cannot say that certificates are reliably free (especially in the long run), if there's only one entity providing them and that entity is dependent on corporate sponsors.

Re: Firefox 83 introduces HTTPS-Only Mode

#222

Post by tialaramex »

iso1631 wrote: post #103
whym wrote: post #23

I wonder how it will work against websites like http://neverssl.com (which helps me to log in to some wifi portals, HTTPS Everywhere shows the prompt for a temporary exception.)

It will say "this website doesn't support https, do you want to connect anyway"

Just checked this yup.

If I go to https://neverssl.com/ I get a warning explaining that this site doesn't have a certificate for neverssl.com but only for Cloudfront (presumably where it's hosted)

But if I try to go to http://neverssl.com/ then I get the message explaining that the HTTPS site doesn't work, do I want the insecure HTTP one instead?

Re: Firefox 83 introduces HTTPS-Only Mode

#223

Post by mox1 »

saurik wrote: post #183
nine_k wrote: post #170

Earlier quoted context omitted.

If only the OS could terminate TLS and allow to filter decrypted traffic locally.

This is prevented by certificate pinning.

You could easily add APIs for cert pinning at the OS level. Or provide the details needed to verify with the OS -> Program call return.

Re: Firefox 83 introduces HTTPS-Only Mode

#224

Post by imtringued »

dusted wrote: post #60
m_eiman wrote: post #53

It's obvious I need to spend more time researching Gemini and similar things. The "web" is going to be a true monoculture very, very soon.

I agree. HTTPS is great, at definitely needed for a lot of things. But I don't need my cat pictures encrypted, I don't need lots of things encrypted, and frankly, I don't want it to be encrypted when it's not required, it's a waste of resources, both processing and network. Then there is the case of all the old computers that either lack the processing power or support for modern algorithms.

Here is the thing. If you enter domain.com into the address bar of your browser, your browser will always go to the http site unless you do HSTS preloading. Your first visit to a website is not secured by https. So lots of people do a http -> https redirect, which means you can do a man in the middle attack on the http port and the HSTS header will never get loaded in the first place. https is significantly less effective than it should be.

Re: Firefox 83 introduces HTTPS-Only Mode

#225

Post by judge2020 »

stephen_g wrote: post #75
mittermayr wrote: post #40

Earlier quoted context omitted.

An alternative I use is http://captive.apple.com (other OS vendors have their own). Which may have a higher chance of being detected by the portal (more likely to be white-listed) and triggering the prompt correctly.

Frustratingly it doesn’t always work that way - one I have seen that is just bizarre is Qantas inflight wifi. It actually allows captive.apple.com to bypass the captive portal, so your iPhone, iPad or Mac thinks it has internet access. So you try to navigate to a page or use an app and just hit HTTPS certificate errors! So you have to think of some other site that is only HTTP or get the information card and enter th…

It might be forging responses from captive.apple.com and not actually sending those out to the internet. If you set up your own intercept that responds 'Success', iOS will assume it has internet as well.

Re: Firefox 83 introduces HTTPS-Only Mode

#227

Post by bullen »

nsomaru wrote: post #204
pmlnr wrote: post #178

HTTPS is brittle. HTTP is insecure, but will run forever. This move will literally kill the old web.

I would hope you could expand on this a bit?

Not OP but:

HTTPS is not secure because it is centralized and it does not protect against MITM.

HTTP is the foundation of our civilization, it will never go away how much certificate sellers try.

But I would go one step further and point out that HTTP can be made secure manually selectively so that you only secure the things that need security!

HTTPS wastes energy by encrypting cat pictures, and we don't have that much cheap energy left!

But don't worry this will not kill HTTP only Mozilla/Chrome. Chromium will always allow adblockers for free and HTTP, because if they remove it, I'll fork it and add it back in, even if it takes 1 day to compile!

Re: Firefox 83 introduces HTTPS-Only Mode

#228

Post by Fnoord »

saurik wrote: post #183
nine_k wrote: post #170

Earlier quoted context omitted.

If only the OS could terminate TLS and allow to filter decrypted traffic locally.

This is prevented by certificate pinning.

Yep, and HTST (if you don't trust that you can use an Firefox addon to perform certificate pinning). I believe HTST got introduced in the wake of the DigiNotar debacle (listen Darknet Diaries #3). Mitmproxy also made it easy.

I guess this Mozilla Firefox change deprecates HTTPS Everywhere.

Either way, we've come a long way. For people in the Dutch security world, DigiNotar was a known joke. I knew about their terrible security (and the implications) back around 2000-2004. Although there have been more vulnerabilities too, such as Hearthbleed and POODLE.

Re: Firefox 83 introduces HTTPS-Only Mode

#230

Post by iso1631 »

tialaramex wrote: post #222
iso1631 wrote: post #103

Earlier quoted context omitted.

It will say "this website doesn't support https, do you want to connect anyway"

Just checked this yup. If I go to https://neverssl.com/ I get a warning explaining that this site doesn't have a certificate for neverssl.com but only for Cloudfront (presumably where it's hosted) But if I try to go to http://neverssl.com/ then I get the message explaining that the HTTPS site doesn't work, do I want the insecure HTTP one instead?

If I specify http://whatever.com in the address bar, or if I follow a link to http://whatever.com, I'd expect it to attempt to connect to port 80 on whatever.com, and not redirect to https unless the page responds with a Location header

If I type "whatever.com", I'm happy with it to try port 443 first

I'm not sure if a http/80 page should be at least HEADed to see if there's a redirect to https/443 before throwing up the "this is not secure"

Post reply on HN