Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 83 introduces HTTPS-Only Mode

blog.mozilla.org

Post reply on HN
Print view View original

291–300 of 525 posts

Re: Firefox 83 introduces HTTPS-Only Mode

#291

Post by ffpip »

hpfr wrote: post #67
ffpip wrote: post #54

Earlier quoted context omitted.

Yes, but one less extension with access to all your history, passwords and all other info.

WebExtensions have permissions and I doubt the EFF requests passwords and history for this extension. It’s also open-source, and although installing it from addons.mozilla.org could introduce some sort of MITM opportunity, as a recommended extension Mozilla puts it through a review process, so it’s about as tame as an extension this capable can get. But yes, it is always nice to reduce extensions installed.

Passwords come under 'access all sites', which HTTPs everywhere needs.

Re: Firefox 83 introduces HTTPS-Only Mode

#292

Post by perryizgr8 »

robertlagrant wrote: post #239
globular-toast wrote: post #91

There's a phenomenon I observe quite regularly in tech. A problem exists and creative people develop an innovative solution to said problem. The solution then becomes popular and a singular goal of uncreative people who deploy said solution everywhere and push it to its logical extreme. I remember seeing this in the mid-2000s when HTML tables were shunned in favour of "divs". I saw people reinventing tables using div…

> Am I supposed to trust them more than some man-in-the-middle just because they own a domain name? You can be assured that you are actually talking to them. That's a big step up from not being able to do that.

Depends on the content of the website. A lot of websites wouldn't benefit at all from that assurance. A lot of blogs and random personal projects come to mind. My own blog does not care about authentication or MITM at all. It would be just an unnecessary complexity without any benefit.

Re: Firefox 83 introduces HTTPS-Only Mode

#293

Post by [deleted] »

gambler wrote: post #244
jorl17 wrote: post #188

Earlier quoted context omitted.

The main problem with keeping sites http is that someone in the middle can modify the content and inject arbitrary code, be it ads, crypto mining or just a redirect to a worse website. Therefore I believe it should be a social duty to make everything https so as to ensure that we don’t create something that can be used to harm others. I didn’t use to think like this until I actually tried it out by going to a mall an…

Funny how "security experts" here complain about accidental non-repudiation misfeature of DKIM, but apparently being forced to do a bunch of crazy crap HTTPS forces you to do when all you need is content signature verification is perfectly fine with those same people. Security is becoming a field dominated by some bizarre corporate ideology.

[deleted]

Re: Firefox 83 introduces HTTPS-Only Mode

#294

Post by simias »

gambler wrote: post #244
jorl17 wrote: post #188

Earlier quoted context omitted.

The main problem with keeping sites http is that someone in the middle can modify the content and inject arbitrary code, be it ads, crypto mining or just a redirect to a worse website. Therefore I believe it should be a social duty to make everything https so as to ensure that we don’t create something that can be used to harm others. I didn’t use to think like this until I actually tried it out by going to a mall an…

Funny how "security experts" here complain about accidental non-repudiation misfeature of DKIM, but apparently being forced to do a bunch of crazy crap HTTPS forces you to do when all you need is content signature verification is perfectly fine with those same people. Security is becoming a field dominated by some bizarre corporate ideology.

I don't understand your point, content signature verification would have the same consequences that HTTPS for non-repudiation, no?

Also it's really different from DKIM: the problem with DKIM is that since the signature is part of the email itself, so unless the receiver bothers to strip it (why would they?) then it's stored forever in the metadata, even though arguably its use as an anti-spam feature stops being relevant once it's been delivered to the MUA. So basically every time you send an email through gmail you effectively also send a signature saying "I, Google, vouch that h4x0r@gmail.com did send this email" and the receiving end will keep this signature for as long as they keep the email.

HTTPS session keys however are not typically saved unless somebody goes out of their way to do it. As such it's a lot less likely to be used for blackmail in hindsight. In general people use archive.org to prove that some content used to exist in this scenario, not old HTTPS session dumps.

And like for DKIM the solution is fairly trivial if it's really an issue: every time you rotate your keys (which should be fairly frequent if you use something like letsencrypt) be sure to make the expired private keys available publicly to give you plausible deniability.

I have yet to hear a good argument against HTTPS everywhere honestly, it generally boils down to "but I don't want to do it" with some weak post-hoc justification for why it's bad.

Re: Firefox 83 introduces HTTPS-Only Mode

#295

Post by wildfire »

josephcsible wrote: post #273
userbinator wrote: post #258

Earlier quoted context omitted.

Therefore I believe it should be a social duty to make everything https so as to ensure that we don’t create something that can be used to harm others. Those who give up freedom for security deserve neither.

Nobody's saying you should be required by law to use HTTPS. Voting is a social duty too and it's not mandatory.

The world would be a better place if voting was mandatory ( like it is in Australia ).

Re: Firefox 83 introduces HTTPS-Only Mode

#296

Post by ffpip »

AntiImperialist wrote: post #65
ffpip wrote: post #54

Earlier quoted context omitted.

Yes, but one less extension with access to all your history, passwords and all other info.

I'm not sure if I trust EFF any less than I trust Mozilla.

I already trust Mozilla with everything. I do everything on my browser. It is always better to reduce extensions. I look forward to a day when I have nothing but uBlock Origin in my browser

Re: Firefox 83 introduces HTTPS-Only Mode

#297

Post by cptskippy »

kd913 wrote: post #161
3np wrote: post #133

Earlier quoted context omitted.

I have mixed feelings about what you wrote. 100% with you that by itself, browser HTTPS-only mode (even by default) is A Good Thing. In isolation, this is a no-brainer and Mozilla's doing the right call. I'm not happy with DoH though, at all. I fall in the crowd who wants to control my own DNS on my own devices (and I do realize that for those less technically knowledgeable, the status quo is putting that in the hand…

Firefox DoH easily works with DNSCryptProxy. https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Local-DoH You can easily set it up to contact that, but enable some exclusions for specific domains if you wish to fallback to pihole. It's probably not that efficient anyway to be using pihole's filtering in Firefox compared with just ublock origin anyway.

> It's probably not that efficient anyway to be using pihole's filtering in Firefox compared with just ublock origin anyway.

Pihole operates at the network level. It can block Windows Telemetry, ads on your Roku, smart devices trying to phone home, etc. Any guest devices that connect to your network also benefit without you having to install blockers on them.

It's not a replacement for ublock, it's used in conjunction with it.

Re: Firefox 83 introduces HTTPS-Only Mode

#298

Post by zrm »

shawnz wrote: post #279
zrm wrote: post #274

Earlier quoted context omitted.

The user can do whatever they want. It's their machine. But you know perfectly well that almost everybody is going to take the default because they don't even know what the setting does, and end up disabling content blocking when they didn't intend to. And in many cases the user is the network operator. What the browser is doing is taking away the mechanism to set local policy. Ordinarily you hand out the DNS you wan…

Yes, and I am saying the default should be to use a guaranteed source of truth and not something set by the network operator's policy. Same as how your trusted root CA certificates don't come from a network policy for example. I don't think we should be making a convention of inspecting users' private traffic, regardless of whether it is by default or by opt-in, under the guise of protecting them from malware. DNS ha…

The problem is "guaranteed source of truth" doesn't exist. When the network operator is you, or your family/company, you may trust the local DNS to respect your privacy more than you do Cloudflare. Not all names are intended to resolve the same everywhere -- sometimes the local DNS will give the RFC1918 address for a local server instead of the public one, or have a set of local names that are only accessible on the local network. How do you propose to globally resolve the reverse lookup zones for 10.0.0.0/8 et al?

Re: Firefox 83 introduces HTTPS-Only Mode

#299

Post by snazz »

gambler wrote: post #244
jorl17 wrote: post #188

Earlier quoted context omitted.

The main problem with keeping sites http is that someone in the middle can modify the content and inject arbitrary code, be it ads, crypto mining or just a redirect to a worse website. Therefore I believe it should be a social duty to make everything https so as to ensure that we don’t create something that can be used to harm others. I didn’t use to think like this until I actually tried it out by going to a mall an…

Funny how "security experts" here complain about accidental non-repudiation misfeature of DKIM, but apparently being forced to do a bunch of crazy crap HTTPS forces you to do when all you need is content signature verification is perfectly fine with those same people. Security is becoming a field dominated by some bizarre corporate ideology.

What "crazy crap" are you talking about? I get that HTTPS might be overkill for some situations, but it's not difficult to use and every client device supports it. If you came up with your own signature-but-no-encryption protocol (maybe something similar to DKIM, actually?), nobody would support it. Even if they did, I'm sure that some people would use it when HTTPS is a better solution, just because they don't understand the tradeoffs.

A standardized overkill solution that covers most use cases is probably better than n+1 standards with different tradeoffs.

Re: Firefox 83 introduces HTTPS-Only Mode

#300

Post by bscphil »

manquer wrote: post #135
iso1631 wrote: post #113

Earlier quoted context omitted.

I run my own networks and my own devices, I choose what options go in my DHCP server If I were on a hostile network (say a hotel), then sure, I'll ignore their DNS server and use my own (or indeed just punch my way out via a VPN), but most of the time I use friendly networks, and I don't want to have to configure 20 different applications on a dozen different boxes to use a DNS provider of my choice. There's a reason…

You are able to run own network and have the know how to do so, typical physical Firefox users cannot. Given your knowledge you can disable or even build firefox with DoH disabled , it is a sensible default for vast majority of users who do not know what DHCP is, or control their network. It cannotis trivial configuration for people who can control and do not want the DoH service provider given by Firefox. Also many…

> Given your knowledge you can disable or even build firefox with DoH disabled , it is a sensible default for vast majority of users who do not know what DHCP is, or control their network. It cannotis trivial configuration for people who can control and do not want the DoH service provider given by Firefox.

I have mixed feelings about the issue, but it's not that simple.

I run a variety of services on my LAN for my users and guests. That includes Unbound, so even though their browser doesn't know it, their queries are secure from my ISP. But more importantly I have other stuff behind hostnames (which are resolved by Unbound). For example, my guests can navigate to music/ and use a web interface to play any of the music in my library over the stereo.

Hopefully it's obvious why this is something useful to have.

Now that Firefox is intercepting DNS requests, a conversation with someone might go like this: "Oh, it's not working? Are you using Firefox? Yeah, Firefox broke this recently, let me get the IP address for you." And then I have to log in to a computer, ssh into the relevant system, and get its IP address on the LAN.

And that's just the beginning. Last I checked Cloudflare still can't resolve the archive.is / archive.today domains. Even though I use Cloudflare over TLS in Unbound, I fix this for myself and my users by sending these domains to Google instead. Anything as convenient and simplistic as Firefox just sending everything directly to Cloudflare can't do that.

Post reply on HN