Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 83 introduces HTTPS-Only Mode

blog.mozilla.org

Post reply on HN
Print view View original

281–290 of 525 posts

Re: Firefox 83 introduces HTTPS-Only Mode

#281

Post by MinusGix »

matsemann wrote: post #83
jchw wrote: post #18

I’m surprised at the negative knee-jerk reaction. I actually love this idea immediately. It encapsulates something I kind of already wanted when using HTTPS Everywhere. This doesn’t guarantee the transport is end-to-end secure; I’m sure plenty will strip the encryption at an LB and then possibly send it back over the internet. But, I think it’s a good addition nevertheless. Here’s to hoping for more DoH and encrypted…

> I’m surprised at the negative knee-jerk reaction. Only Chrome is allowed to break stuff on the web, remember?

This site is likely to get annoyed at Chrome as well. Also, just because Chrome gets away with it doesn't mean its an action that should be accepted purely for that reasoning.

Re: Firefox 83 introduces HTTPS-Only Mode

#282

Post by cesarb »

doublerabbit wrote: post #220
jorl17 wrote: post #188

Earlier quoted context omitted.

The main problem with keeping sites http is that someone in the middle can modify the content and inject arbitrary code, be it ads, crypto mining or just a redirect to a worse website. Therefore I believe it should be a social duty to make everything https so as to ensure that we don’t create something that can be used to harm others. I didn’t use to think like this until I actually tried it out by going to a mall an…

> The main problem with keeping sites http is that someone in the middle can modify the content and inject arbitrary code I keep hearing this as a plausible excuse, yet I've never seen any proof of such. non-https does make it possible but has anyone got any source where someone has been victim of such attacks?

> has anyone got any source where someone has been victim of such attacks?

Yes, the most well-known victim was GitHub. A malicious MITM injected JavaScript code into an unrelated non-HTTPS page, making browsers which visited that page do a DDoS attack against GitHub. Quoting https://arstechnica.com/information-technology/2015/04/meet-... "[...] The junk traffic came from computers of everyday people who browsed to websites that use analytics software from Chinese search engine Baidu to track visitor statistics. About one or two percent of the visits from people outside China had malicious code inserted into their traffic that caused their computers to repeatedly load the two targeted GitHub pages. [...]"

Re: Firefox 83 introduces HTTPS-Only Mode

#283

Post by josephcsible »

m_eiman wrote: post #184
dewey wrote: post #59

Earlier quoted context omitted.

Using https is making the web a monoculture?

It's part of the culture of making everything web terribly complicated, which has resulted in the death of all but three web browsers. It's now practically impossible to write a new web browser from scratch, unless you're a mega corp with endless resources and a grudge against Google, and they're still adding more complexity every day.

Supporting TLS is a cakewalk compared to handling modern HTML/JS/etc. This has nothing to do with the browser monoculture.

Re: Firefox 83 introduces HTTPS-Only Mode

#284

Post by josephcsible »

jevgeni wrote: post #221
dewey wrote: post #79

Earlier quoted context omitted.

What makes it more expensive? A certificate is free (With LE or self-signed), the performance impact is negligible and there's a clear reason for why everyone should be using it.

You cannot say that certificates are reliably free (especially in the long run), if there's only one entity providing them and that entity is dependent on corporate sponsors.

We can't say that a true statement is true just because there's a chance that at some point it becomes false?

Re: Firefox 83 introduces HTTPS-Only Mode

#285

Post by MinusGix »

whym wrote: post #23

I wonder how it will work against websites like http://neverssl.com (which helps me to log in to some wifi portals, HTTPS Everywhere shows the prompt for a temporary exception.)

I personally access 10.0.0.1 and that works at numerous places with wifi portals. Especially useful when my device/browser doesn't automatically detect that there is a captive portal.

Re: Firefox 83 introduces HTTPS-Only Mode

#286

Post by jillesvangurp »

Good feature in general. A few old sites that will get a bit more annoying to use because that fact is now pointed out to the user. But otherwise no impact for users.

I hope it does not get too annoying for backend developers for running things locally because locally you typically don't set up https.

Re: Firefox 83 introduces HTTPS-Only Mode

#287

Post by josephcsible »

afiori wrote: post #138
globular-toast wrote: post #91

There's a phenomenon I observe quite regularly in tech. A problem exists and creative people develop an innovative solution to said problem. The solution then becomes popular and a singular goal of uncreative people who deploy said solution everywhere and push it to its logical extreme. I remember seeing this in the mid-2000s when HTML tables were shunned in favour of "divs". I saw people reinventing tables using div…

> Am I supposed to trust them more than some man-in-the-middle just because they own a domain name? The green padlock will not turn any unreliable fake news site of your choise in a trustworthy outlet but it does make some guarantees about it being the same site as yesterday (barring security leaks or missed DNS renewal) AFAIU the elefant in the room is that if your DNS resolver is malicious and points all domains to…

> if your DNS resolver is malicious and points all domains to a malicious IP then https is completely useless.

100% false. HTTPS absolutely protects against that.

Re: Firefox 83 introduces HTTPS-Only Mode

#288

Post by MayeulC »

peterwwillis wrote: post #192

A long time ago I suggested a new uri prefix - "secure://" - that would be a synonym for "HTTPS-only". If you visit a secure:// link, every single page load in the session would require strong encryption, secure cookies, etc. The idea was to allow http if needed, and alternately allow strict https if needed, in a backwards compatible way (visiting a https:// url would work as before, but visiting secure:// would trig…

A lot of things should be better in theory, like adopting PAKE schemes (like "OPAQUE") that could perform a two-way authentication and key negociation over an insecure connection by just displaying a login prompt.

As always, the issue is adoption. What good is a solution if no browsers implement it? Catch-22, which is usually broken when a giant (google nowadays) decides to break it. And they need incentives to do so. Which is why we need the non-profit Mozilla giant. badly.

https://en.wikipedia.org/wiki/Password-authenticated_key_agr...

https://news.ycombinator.com/item?id=18259393

https://tools.ietf.org/html/draft-krawczyk-cfrg-opaque-06

Re: Firefox 83 introduces HTTPS-Only Mode

#289

Post by cptskippy »

emn13 wrote: post #236
3np wrote: post #133

Earlier quoted context omitted.

I have mixed feelings about what you wrote. 100% with you that by itself, browser HTTPS-only mode (even by default) is A Good Thing. In isolation, this is a no-brainer and Mozilla's doing the right call. I'm not happy with DoH though, at all. I fall in the crowd who wants to control my own DNS on my own devices (and I do realize that for those less technically knowledgeable, the status quo is putting that in the hand…

I don't understand this criticism at all; could you clarify what the issue is? None of this - DoH, nor HTTPS-only - is required. It's not even on by default (yet). If you have some specific wishes; it's trivial to pick a different DNS system, or leave https-only off. Additionally, DoH and https-only aren't really closed or locked in in any way. There's a cloudflare-base DoH option that's used by default, but just as…

> None of this - DoH, nor HTTPS-only - is required. It's not even on by default (yet).

I had to disable DoH on all 5 of my machines because it was enabled automatically.

> You mention pihole; and though I've never used it, they do have a page on DoH

pihole supports using Cloudflare as an upstream DoH provider, not acting as a DoH provider.

Re: Firefox 83 introduces HTTPS-Only Mode

#290

Post by ffpip »

Hamuko wrote: post #234
ffpip wrote: post #55

I've used this for a few months now. It ugrades non-https connections on secure pages automatically. Very useful. Even big sites like microsoft, google images serve things over http dom.security.https_only_mode = true

I tried this but I ran into a lot of issues so I just turned it off again. For example: Twitter would periodically refuse to load. You'd have to force refresh Twitter for it to load once again.

The twitter problem is not related to this. Even I get it with this tweak disabled. It's definitely some other about:config tweak we have enabled.
Post reply on HN