Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 83 introduces HTTPS-Only Mode

blog.mozilla.org

Post reply on HN
Print view View original

271–280 of 525 posts

Re: Firefox 83 introduces HTTPS-Only Mode

#271

Post by taftster »

cat199 wrote: post #214
new23d wrote: post #44

Earlier quoted context omitted.

Fully support this argument and Mozilla's initiative. I work for a firewall co and we had taken a strategic decision to not allow plaintext traffic onto the internet (from cloud deployments). It's just lazy on the client or server operator's part to not have it so.

this breaks caching of simple objects that do not require content security

Even "simple objects" can be MITM'd. I know I'm on the extreme theoretical edge, and so maybe your perspective is pragmatic enough to pass. But even small images, javascripts, etc. should be protected by HTTPS, not just "sensitive" pages.

As an end user, I don't want the possibility of anything being tampered with along the route. As a content owner / webmaster, I want the same. So publisher and consumer are both aligned in their desire, making HTTPS ideal for everyone except for people reading/manipulating traffic along the way.

Re: Firefox 83 introduces HTTPS-Only Mode

#272

Post by Karunamon »

taftster wrote: post #267
userbinator wrote: post #254

Earlier quoted context omitted.

I’m surprised at the negative knee-jerk reaction Increased corporate/government control and centralisation. That is a huge "do not want" for many of the HN crowd, including me.

Honest question. How is this feature enabling increased corporate/government control?

Because now almost every Firefox user will be sending their DNS straight to one centralized provider, a large corporation, which makes them more vulnerable to various kinds of government interference.

Re: Firefox 83 introduces HTTPS-Only Mode

#273

Post by josephcsible »

userbinator wrote: post #258
jorl17 wrote: post #188

Earlier quoted context omitted.

The main problem with keeping sites http is that someone in the middle can modify the content and inject arbitrary code, be it ads, crypto mining or just a redirect to a worse website. Therefore I believe it should be a social duty to make everything https so as to ensure that we don’t create something that can be used to harm others. I didn’t use to think like this until I actually tried it out by going to a mall an…

Therefore I believe it should be a social duty to make everything https so as to ensure that we don’t create something that can be used to harm others. Those who give up freedom for security deserve neither.

Nobody's saying you should be required by law to use HTTPS. Voting is a social duty too and it's not mandatory.

Re: Firefox 83 introduces HTTPS-Only Mode

#274

Post by zrm »

shawnz wrote: post #263
zrm wrote: post #261

Earlier quoted context omitted.

The issue is with Firefox overriding the system DNS with its own by default, when the system DNS may have content blocking applied and the Firefox default may not.

I think if the user wants that, they should choose to apply it. Not the network operator. Same as how I wouldn't want my network operator inspecting my HTTPS traffic for malware.

The user can do whatever they want. It's their machine. But you know perfectly well that almost everybody is going to take the default because they don't even know what the setting does, and end up disabling content blocking when they didn't intend to.

And in many cases the user is the network operator. What the browser is doing is taking away the mechanism to set local policy. Ordinarily you hand out the DNS you want your devices to use via DHCP, and they use it. If you move that from the OS to the application and the application ignores the DHCP setting by default, now you've lost the ability to set a uniform policy for all your devices and applications. It becomes an arduous manual process to change the setting in every application on every device, and then you probably miss half of them.

Re: Firefox 83 introduces HTTPS-Only Mode

#275

Post by kevinoid »

autoexec wrote: post #78
m4lvin wrote: post #69

Earlier quoted context omitted.

Thanks for mentioning this! This about:config flag is also available in Firefox ESR 78 already (but there is no GUI for it yet).

Are there about:config entries to handle excluded sites?

I was interested in this as well. Unfortunately, excluded sites are configured using PermissionManager https://bugzilla.mozilla.org/1640853> which stores data in permissions.sqlite.

Re: Firefox 83 introduces HTTPS-Only Mode

#276

Post by josephcsible »

at_a_remove wrote: post #250

Once this sort of thing is widely accepted, we'll see various blogs and websites silenced by having a certificate revoked. Not right away but soon enough. It's a very exciting development. It's managed to use the geek "Everything has to be like this! " fanaticism to drag in a mechanism of control. I wonder which of the Four Horsemen it will be used against first.

There's a ton of trusted roots across multiple countries. I think the odds are virtually nil that none of them would let you have a certificate.

Re: Firefox 83 introduces HTTPS-Only Mode

#277

Post by josephcsible »

gostsamo wrote: post #37
CodesInChaos wrote: post #29

One change I'd like to see in browsers is when the user enters a domain without protocol in the url bar it interprets that as https instead of http.

This is exactly the https mode.

The difference is what happens if you type http manually.

Re: Firefox 83 introduces HTTPS-Only Mode

#278

Post by [deleted] »

userbinator wrote: post #258
jorl17 wrote: post #188

Earlier quoted context omitted.

The main problem with keeping sites http is that someone in the middle can modify the content and inject arbitrary code, be it ads, crypto mining or just a redirect to a worse website. Therefore I believe it should be a social duty to make everything https so as to ensure that we don’t create something that can be used to harm others. I didn’t use to think like this until I actually tried it out by going to a mall an…

Therefore I believe it should be a social duty to make everything https so as to ensure that we don’t create something that can be used to harm others. Those who give up freedom for security deserve neither.

[deleted]

Re: Firefox 83 introduces HTTPS-Only Mode

#279

Post by shawnz »

zrm wrote: post #274
shawnz wrote: post #263

Earlier quoted context omitted.

I think if the user wants that, they should choose to apply it. Not the network operator. Same as how I wouldn't want my network operator inspecting my HTTPS traffic for malware.

The user can do whatever they want. It's their machine. But you know perfectly well that almost everybody is going to take the default because they don't even know what the setting does, and end up disabling content blocking when they didn't intend to. And in many cases the user is the network operator. What the browser is doing is taking away the mechanism to set local policy. Ordinarily you hand out the DNS you wan…

Yes, and I am saying the default should be to use a guaranteed source of truth and not something set by the network operator's policy. Same as how your trusted root CA certificates don't come from a network policy for example. I don't think we should be making a convention of inspecting users' private traffic, regardless of whether it is by default or by opt-in, under the guise of protecting them from malware.

DNS has historically been set by network policy so that it's easy for network operators to map hostnames to their local network resources. The point of the design wasn't to enable traffic monitoring or content blocking by altering the results for hosts that aren't under your control.

Re: Firefox 83 introduces HTTPS-Only Mode

#280

Post by josephcsible »

bullen wrote: post #246
jaas wrote: post #137

Earlier quoted context omitted.

If a page doesn't use HTTPS, even if it is cats, you cannot trust that the traffic has not been modified in transit. You try to load a cat but a network attacker can add malware or mining code or a worse exploit. Every page needs HTTPS because you can't trust any content sent to you over HTTP. You don't know if it's "just a cat picture."

Only routing owners can modify the cat picture, do you think they can afford to when the browser does not "run" the cat picture?

Image decoders occasionally have RCE vulnerabilities.
Post reply on HN