Firefox 83 introduces HTTPS-Only Mode • Hacker News Board

Re: Firefox 83 introduces HTTPS-Only Mode

#251

Post by zrm » Tue, Nov 17, 2020, 2:40 PM UTC

shawnz wrote: post #248

zrm wrote: post #242

Earlier quoted context omitted.

> At its most basic, they could hardcode lists of IPs into their malicious code. Which makes the malware more fragile, because the hosts are often compromised machines themselves, or are the targets of takedowns. If they include only one IP at a time (as they can do with DNS) then when that machine gets cleaned by the owners, they have no way to switch to another one. If they list several machines then anyone analyzi…

Hardcoding the IP certainly has limitations but that is only the easiest example of bypassing DNS-based content blocking. A slightly less trivial solution where you grab the IP out of a file over HTTP instead could be easily implemented by any junior developer. > Also, if they use an IP address then they can't be using SNI to host it on the same IP address as several other domains Sure they can, just hardcode the "Ho…

> A slightly less trivial solution where you grab the IP out of a file over HTTP instead could be easily implemented by any junior developer.

Over HTTP from what? You would need name resolution or a hard-coded IP address to make an HTTP request.

And the thing this is preventing isn't just what the malware does after you're already infected, it's the path to receiving malware to begin with.

Re: Firefox 83 introduces HTTPS-Only Mode

#252

Post by MayeulC » Tue, Nov 17, 2020, 2:41 PM UTC

devit wrote: post #237

whym wrote: post #23

I wonder how it will work against websites like http://neverssl.com (which helps me to log in to some wifi portals, HTTPS Everywhere shows the prompt for a temporary exception.)

It might be time to introduce a protocol that allows networks to display authentication prompts without needing to MITM HTTP connections. It's not even hard, all that's needed is to add an "authentication URL" field to DHCP and IPv6 router advertisements.

Isn't it part of what "Hotspot 2.0" (https://en.wikipedia.org/wiki/Hotspot_%28Wi-Fi%29#Hotspot_2....) provides?

It certainly solves the login part, it might also solve the register part?

Re: Firefox 83 introduces HTTPS-Only Mode

#253

Post by shawnz » Tue, Nov 17, 2020, 2:42 PM UTC

zrm wrote: post #251

shawnz wrote: post #248

Earlier quoted context omitted.

Hardcoding the IP certainly has limitations but that is only the easiest example of bypassing DNS-based content blocking. A slightly less trivial solution where you grab the IP out of a file over HTTP instead could be easily implemented by any junior developer. > Also, if they use an IP address then they can't be using SNI to host it on the same IP address as several other domains Sure they can, just hardcode the "Ho…

> A slightly less trivial solution where you grab the IP out of a file over HTTP instead could be easily implemented by any junior developer. Over HTTP from what? You would need name resolution or a hard-coded IP address to make an HTTP request. And the thing this is preventing isn't just what the malware does after you're already infected, it's the path to receiving malware to begin with.

And don't you similarly also need name resolution or a hard-coded IP address in order to reach a malicious DoH server?

Re: Firefox 83 introduces HTTPS-Only Mode

#254

Post by userbinator » Tue, Nov 17, 2020, 2:43 PM UTC

jchw wrote: post #18

I’m surprised at the negative knee-jerk reaction. I actually love this idea immediately. It encapsulates something I kind of already wanted when using HTTPS Everywhere. This doesn’t guarantee the transport is end-to-end secure; I’m sure plenty will strip the encryption at an LB and then possibly send it back over the internet. But, I think it’s a good addition nevertheless. Here’s to hoping for more DoH and encrypted…

I’m surprised at the negative knee-jerk reaction

Increased corporate/government control and centralisation. That is a huge "do not want" for many of the HN crowd, including me.

Re: Firefox 83 introduces HTTPS-Only Mode

#255

Post by tialaramex » Tue, Nov 17, 2020, 2:43 PM UTC

devit wrote: post #237

whym wrote: post #23

I wonder how it will work against websites like http://neverssl.com (which helps me to log in to some wifi portals, HTTPS Everywhere shows the prompt for a temporary exception.)

It might be time to introduce a protocol that allows networks to display authentication prompts without needing to MITM HTTP connections. It's not even hard, all that's needed is to add an "authentication URL" field to DHCP and IPv6 router advertisements.

https://tools.ietf.org/html/rfc8910 Captive-Portal Identification in DHCP and Router Advertisements (RAs)

Actually the future is ambient network access. But on the way there, the likely pathway is larger and larger federated network authentication. Most of the world's higher education students/ staff are enrolled into EduROAM, so that it doesn't matter if they're in a classroom in Tokyo or London, the federated system concludes they are a legitimate user somewhere and so they can connect here. In these federated systems there's no use for a "Captive portal" since it could not safely achieve federated authentication, so there isn't one.

Re: Firefox 83 introduces HTTPS-Only Mode

#256

Post by einpoklum » Tue, Nov 17, 2020, 2:43 PM UTC

zajio1am wrote: post #158

Hot take: HTTPS-only mode is a bad idea if it is not paired with first-class support for self-signed certificates authorized using DANE+DNSSec. It just forces everyone to use broken/redundant CA model.

You can't pair a capability of the web server with a client browser...

Re: Firefox 83 introduces HTTPS-Only Mode

#257

Post by zrm » Tue, Nov 17, 2020, 2:43 PM UTC

shawnz wrote: post #253

zrm wrote: post #251

Earlier quoted context omitted.

> A slightly less trivial solution where you grab the IP out of a file over HTTP instead could be easily implemented by any junior developer. Over HTTP from what? You would need name resolution or a hard-coded IP address to make an HTTP request. And the thing this is preventing isn't just what the malware does after you're already infected, it's the path to receiving malware to begin with.

And don't you similarly also need name resolution or a hard-coded IP address in order to reach a malicious DoH server?

It's not a malicious DoH server. It's just any DoH server which is bypassing your Pi-hole and therefore resolves the malicious name instead of blocking it.

Re: Firefox 83 introduces HTTPS-Only Mode

#258

Post by userbinator » Tue, Nov 17, 2020, 2:44 PM UTC

jorl17 wrote: post #188

Jaruzel wrote: post #118

awww crap - I've got loads of low-traffic websites that don't need https[1] that I'm now going to have to spend time sorting out certificates for. To be honest, it's about time that cert enablement is built into all web server configs (on all OSs) as a native feature instead of having to manually roll the config using this-weeks-currently-preferred letsencrypt script. --- [1] Yes, yes, I know everyone on HN prefers e…

The main problem with keeping sites http is that someone in the middle can modify the content and inject arbitrary code, be it ads, crypto mining or just a redirect to a worse website. Therefore I believe it should be a social duty to make everything https so as to ensure that we don’t create something that can be used to harm others. I didn’t use to think like this until I actually tried it out by going to a mall an…

Therefore I believe it should be a social duty to make everything https so as to ensure that we don’t create something that can be used to harm others.

Those who give up freedom for security deserve neither.

Re: Firefox 83 introduces HTTPS-Only Mode

#259

Post by shawnz » Tue, Nov 17, 2020, 2:45 PM UTC

zrm wrote: post #257

shawnz wrote: post #253

Earlier quoted context omitted.

And don't you similarly also need name resolution or a hard-coded IP address in order to reach a malicious DoH server?

It's not a malicious DoH server. It's just any DoH server which is bypassing your Pi-hole and therefore resolves the malicious name instead of blocking it.

That's not the point. Don't you need to hardcode some kind of identifier in order to use your malware's preferred DoH server instead of the user's preferred one (which could have content blocking applied)?

Re: Firefox 83 introduces HTTPS-Only Mode

#260

Post by aljarry » Tue, Nov 17, 2020, 2:46 PM UTC

implying wrote: post #77

This is a great step, but I wish browsers would allow you to set domains that are considered to be secure origins in all cases. I have a decent intranet with transport security guaranteed by VPN, but because it isn't "HTTPS" I can't access tons of browser features.

I've set up internal CA using minica [0] and trusted that CA in Chrome and Firefox with success. Each host got it's own key, and I'm not even using proper DNS server - I use Avahi, so all of my hosts are available as somehostname.local on all clients with Avahi/Bonjour installed.

[0] https://github.com/jsha/minica