Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 83 introduces HTTPS-Only Mode

blog.mozilla.org

Post reply on HN
Print view View original

261–270 of 525 posts

Re: Firefox 83 introduces HTTPS-Only Mode

#261

Post by zrm »

shawnz wrote: post #259
zrm wrote: post #257

Earlier quoted context omitted.

It's not a malicious DoH server. It's just any DoH server which is bypassing your Pi-hole and therefore resolves the malicious name instead of blocking it.

That's not the point. Don't you need to hardcode some kind of identifier in order to use your malware's preferred DoH server instead of the user's preferred one (which could have content blocking applied)?

The issue is with Firefox overriding the system DNS with its own by default, when the system DNS may have content blocking applied and the Firefox default may not.

Re: Firefox 83 introduces HTTPS-Only Mode

#262

Post by new23d »

cat199 wrote: post #214
new23d wrote: post #44

Earlier quoted context omitted.

Fully support this argument and Mozilla's initiative. I work for a firewall co and we had taken a strategic decision to not allow plaintext traffic onto the internet (from cloud deployments). It's just lazy on the client or server operator's part to not have it so.

this breaks caching of simple objects that do not require content security

From intermediate (MITM) caches, yes. But end-clients can still cache it though.

Our market is more backend API traffic so doesn't impact as much.

Re: Firefox 83 introduces HTTPS-Only Mode

#263

Post by shawnz »

zrm wrote: post #261
shawnz wrote: post #259

Earlier quoted context omitted.

That's not the point. Don't you need to hardcode some kind of identifier in order to use your malware's preferred DoH server instead of the user's preferred one (which could have content blocking applied)?

The issue is with Firefox overriding the system DNS with its own by default, when the system DNS may have content blocking applied and the Firefox default may not.

I think if the user wants that, they should choose to apply it. Not the network operator. Same as how I wouldn't want my network operator inspecting my HTTPS traffic for malware.

Re: Firefox 83 introduces HTTPS-Only Mode

#264

Post by ldjb »

iso1631 wrote: post #230
tialaramex wrote: post #222

Earlier quoted context omitted.

Just checked this yup. If I go to https://neverssl.com/ I get a warning explaining that this site doesn't have a certificate for neverssl.com but only for Cloudfront (presumably where it's hosted) But if I try to go to http://neverssl.com/ then I get the message explaining that the HTTPS site doesn't work, do I want the insecure HTTP one instead?

If I specify http://whatever.com in the address bar, or if I follow a link to http://whatever.com , I'd expect it to attempt to connect to port 80 on whatever.com, and not redirect to https unless the page responds with a Location header If I type "whatever.com", I'm happy with it to try port 443 first I'm not sure if a http/80 page should be at least HEADed to see if there's a redirect to https/443 before throwing u…

I can understand your use case, but I know a lot of people (often those who use computers infrequently) type out the full URL all the time. They don't know what HTTP or HTTPS is, they don't realise you can omit that part. They just want to access the website.

For those people, it makes sense that typing "http://" would take them to the "https://" site if available. Although they did specify HTTP, it isn't necessarily what they actually wanted.

I think the use case you describe (whilst valid) only applies to a relatively small pool of people. Most people don't really understand HTTP or HTTPS very well. They know it's part of the web address, and some know that "https://" is "secure", but that's about it.

I think it makes sense to direct people to the secure version of the site as much as possible, whilst of course providing a mechanism to switch to the HTTP version if necessary.

Re: Firefox 83 introduces HTTPS-Only Mode

#265

Post by einpoklum »

This is a "rewriting reality to fit our agenda" kind of a post.

> The majority of websites already support HTTPS

When I run a webserver on a machine I just set up, it has no certificate, certainly not one signed by anybody else, and there's no reason I need to be forced to use encryption with it.

> and those that don’t are increasingly uncommon.

False. Although - for fashionable Silicon Valley companies, "most websites" probably means something like Facebook, Google, Amazon, Wikipedia and a few others.

> Regrettably, websites often fall back to using the insecure and outdated HTTP protocol.

HTTP is "outdated"? "Fall back"? ... Seriously?

I guess we're just lucky FF's share has dropped so far that we shouldn't worry about this stuff. I just hope other browsers don't do this (although - who knows, right?)

Re: Firefox 83 introduces HTTPS-Only Mode

#266

Post by MayeulC »

bullen wrote: post #227
nsomaru wrote: post #204

Earlier quoted context omitted.

I would hope you could expand on this a bit?

Not OP but: HTTPS is not secure because it is centralized and it does not protect against MITM. HTTP is the foundation of our civilization, it will never go away how much certificate sellers try. But I would go one step further and point out that HTTP can be made secure manually selectively so that you only secure the things that need security! HTTPS wastes energy by encrypting cat pictures, and we don't have that mu…

To me, HTTP is the wrong target. It would be much more interesting to replace IP, like Yggdrasil does (and I think gnunet, cjdns, hyperboria & others).

If you IP is a cryptographic identifier:

* It cannot be forged

* Anyone can generate a new one on-demand

* Every packet is authenticated, every packet can be encrypted

* TLS becomes redundant

However, the DNS part remains a hard one. How to securely link to websites you have never seen? Pet names seem like a way to do so. Asking users to type IP addresses isn't really an answer, I think, but I don't know if there's a lot of "basic" users who type URLs in nowadays, they all seem to rely on google providing the right website anyway, or the web browser itself.

It's not like DNS is also our single source of trust nowadays, but at least certificate providers are competent enough to make sure names are resolved correctly.

One option would be to make signed DNS records over a DHT: the root authority "." signs "com", "net", etc, that sign "ycombinator", etc. Publish to DHT, hash-indexed.

Of course, point-to-point connections have their weaknesses as well, it might be interesting to migrate to something like beaker browser (html on top of hypercore, formerly DAT, kind of like mutable torrents in a DHT). At the end of the day, the core issue is: migrating users is difficult if the benefits are not immediately obvious.

And yes, massively adopting anything else would litterally "kill the old web", in the protocol sense. In the community or content sense? Not so sure.

https://yggdrasil-network.github.io/

https://gnunet.org/en/

https://github.com/cjdelisle/cjdns/

https://beakerbrowser.com/

https://hypercore-protocol.org/

Re: Firefox 83 introduces HTTPS-Only Mode

#267

Post by taftster »

userbinator wrote: post #254
jchw wrote: post #18

I’m surprised at the negative knee-jerk reaction. I actually love this idea immediately. It encapsulates something I kind of already wanted when using HTTPS Everywhere. This doesn’t guarantee the transport is end-to-end secure; I’m sure plenty will strip the encryption at an LB and then possibly send it back over the internet. But, I think it’s a good addition nevertheless. Here’s to hoping for more DoH and encrypted…

I’m surprised at the negative knee-jerk reaction Increased corporate/government control and centralisation. That is a huge "do not want" for many of the HN crowd, including me.

Honest question. How is this feature enabling increased corporate/government control?

Re: Firefox 83 introduces HTTPS-Only Mode

#268

Post by Jaruzel »

abdusco wrote: post #130
Jaruzel wrote: post #118

awww crap - I've got loads of low-traffic websites that don't need https[1] that I'm now going to have to spend time sorting out certificates for. To be honest, it's about time that cert enablement is built into all web server configs (on all OSs) as a native feature instead of having to manually roll the config using this-weeks-currently-preferred letsencrypt script. --- [1] Yes, yes, I know everyone on HN prefers e…

Take a look at Caddy server. Every site is configured for https by default with auto-renewed letsencrypt certificates. It even has an nginx-compatible configuration (but I think you'll like it's own (really simple) config more)

I'll check it out - cheers!

Re: Firefox 83 introduces HTTPS-Only Mode

#269

Post by zo1 »

emn13 wrote: post #236
3np wrote: post #133

Earlier quoted context omitted.

I have mixed feelings about what you wrote. 100% with you that by itself, browser HTTPS-only mode (even by default) is A Good Thing. In isolation, this is a no-brainer and Mozilla's doing the right call. I'm not happy with DoH though, at all. I fall in the crowd who wants to control my own DNS on my own devices (and I do realize that for those less technically knowledgeable, the status quo is putting that in the hand…

I don't understand this criticism at all; could you clarify what the issue is? None of this - DoH, nor HTTPS-only - is required. It's not even on by default (yet). If you have some specific wishes; it's trivial to pick a different DNS system, or leave https-only off. Additionally, DoH and https-only aren't really closed or locked in in any way. There's a cloudflare-base DoH option that's used by default, but just as…

Not OP. Did we ever allow browsers to set their own DNS server for plain DNS requests? (Let's ignore IE and it's mess of mixing OS settings + browser settings a la "Internet Settings").

For me at least, the biggest criticism of DoH is that it's not necessarily a centralized config at the OS level and seems to be a step in the direction of the general theme "Browser As Your OS".

Re: Firefox 83 introduces HTTPS-Only Mode

#270

Post by Karunamon »

rhubinak wrote: post #209
iso1631 wrote: post #87

Earlier quoted context omitted.

I want my OS to do DNS - including DOH, not my browser. I want a single source for my DNS I want my network to tell me a DNS server to use. As I own my computer I can override that, but much of the time I want to use the network provided DNS server.

Easily doable (at least for the browser): https://support.mozilla.org/en-US/kb/canary-domain-use-appli...

So now I have to add fake DNS records for every application that decides to do their own special snowflake thing and ignore the source of truth for what DNS server to use?

Oh joy.

I run DHCP for a reason. That reason is telling devices on my network what their settings should be. I expect those settings to be honored, not them doing the electronic equivalent of "okay boomer" and using whatever arbitrary settings they were told to by a corporation.

Post reply on HN