Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 83 introduces HTTPS-Only Mode

blog.mozilla.org

Post reply on HN
Print view View original

301–310 of 525 posts

Re: Firefox 83 introduces HTTPS-Only Mode

#301

Post by josephcsible »

iso1631 wrote: post #87
jchw wrote: post #18

I’m surprised at the negative knee-jerk reaction. I actually love this idea immediately. It encapsulates something I kind of already wanted when using HTTPS Everywhere. This doesn’t guarantee the transport is end-to-end secure; I’m sure plenty will strip the encryption at an LB and then possibly send it back over the internet. But, I think it’s a good addition nevertheless. Here’s to hoping for more DoH and encrypted…

I want my OS to do DNS - including DOH, not my browser. I want a single source for my DNS I want my network to tell me a DNS server to use. As I own my computer I can override that, but much of the time I want to use the network provided DNS server.

What you want would make censorship and surveillance easier against the vast majority of people. Networks I'm on shouldn't be able to tell which CloudFlare-hosted site I'm visiting, or to block some of them without blocking them all. Letting the network give me a DNS resolver instead of using a known-good one would allow exactly those bad things.

Re: Firefox 83 introduces HTTPS-Only Mode

#302

Post by BeefySwain »

josephcsible wrote: post #273
userbinator wrote: post #258

Earlier quoted context omitted.

Therefore I believe it should be a social duty to make everything https so as to ensure that we don’t create something that can be used to harm others. Those who give up freedom for security deserve neither.

Nobody's saying you should be required by law to use HTTPS. Voting is a social duty too and it's not mandatory.

https://en.wikipedia.org/wiki/Compulsory_voting

Re: Firefox 83 introduces HTTPS-Only Mode

#303

Post by shawnz »

zrm wrote: post #298
shawnz wrote: post #279

Earlier quoted context omitted.

Yes, and I am saying the default should be to use a guaranteed source of truth and not something set by the network operator's policy. Same as how your trusted root CA certificates don't come from a network policy for example. I don't think we should be making a convention of inspecting users' private traffic, regardless of whether it is by default or by opt-in, under the guise of protecting them from malware. DNS ha…

The problem is "guaranteed source of truth" doesn't exist. When the network operator is you, or your family/company, you may trust the local DNS to respect your privacy more than you do Cloudflare. Not all names are intended to resolve the same everywhere -- sometimes the local DNS will give the RFC1918 address for a local server instead of the public one, or have a set of local names that are only accessible on the…

If the DNS set by DHCP were only used for local network resources and not internet resources, I wouldn't have a problem with that. That is what it is there for.

Re: Firefox 83 introduces HTTPS-Only Mode

#304

Post by josephcsible »

BeefySwain wrote: post #302
josephcsible wrote: post #273

Earlier quoted context omitted.

Nobody's saying you should be required by law to use HTTPS. Voting is a social duty too and it's not mandatory.

https://en.wikipedia.org/wiki/Compulsory_voting

In the United States, it's considered a social duty but isn't mandatory.

Re: Firefox 83 introduces HTTPS-Only Mode

#305

Post by floatingatoll »

gambler wrote: post #244
jorl17 wrote: post #188

Earlier quoted context omitted.

The main problem with keeping sites http is that someone in the middle can modify the content and inject arbitrary code, be it ads, crypto mining or just a redirect to a worse website. Therefore I believe it should be a social duty to make everything https so as to ensure that we don’t create something that can be used to harm others. I didn’t use to think like this until I actually tried it out by going to a mall an…

Funny how "security experts" here complain about accidental non-repudiation misfeature of DKIM, but apparently being forced to do a bunch of crazy crap HTTPS forces you to do when all you need is content signature verification is perfectly fine with those same people. Security is becoming a field dominated by some bizarre corporate ideology.

It’s perfectly fine only to the people who already did it; there are visibly annoyed comment from people who haven’t yet because they think it’s pointless, too. The same issue exists with DNS-over-HTTPS: most people don’t want to have to take new and extra steps to monitor DNS traffic in their home or work, and the concept of having to do that work varies from annoying to offensive (whether they use them or not).

DNS-over-HTTPS is one in a long series of decisions that contradict the assumption that network operators deserve cleartext access to your traffic. I suppose we can thank the NSA’s Room 641A for inspiring the tech world to pivot to this view all those years ago. It’s finally reaching critical mass, and endpoint network operators are furious at having their sniffing/spying capabilities hindered.

Captive WiFi portals are next on that list of institutions that are at risk of failing. I can’t wait, personally.

Re: Firefox 83 introduces HTTPS-Only Mode

#306

Post by ori_b »

shawnz wrote: post #263
zrm wrote: post #261

Earlier quoted context omitted.

The issue is with Firefox overriding the system DNS with its own by default, when the system DNS may have content blocking applied and the Firefox default may not.

I think if the user wants that, they should choose to apply it. Not the network operator. Same as how I wouldn't want my network operator inspecting my HTTPS traffic for malware.

I'm the user and the network operator. Can you give me a comprehensive list of places I need to configure, and notify me when another place software can go around my configuration is added?

Re: Firefox 83 introduces HTTPS-Only Mode

#307

Post by winded_italics »

Karunamon wrote: post #272
taftster wrote: post #267

Earlier quoted context omitted.

Honest question. How is this feature enabling increased corporate/government control?

Because now almost every Firefox user will be sending their DNS straight to one centralized provider, a large corporation, which makes them more vulnerable to various kinds of government interference.

This change isn't about DoH.

Re: Firefox 83 introduces HTTPS-Only Mode

#308

Post by CodesInChaos »

gostsamo wrote: post #37
CodesInChaos wrote: post #29

One change I'd like to see in browsers is when the user enters a domain without protocol in the url bar it interprets that as https instead of http.

This is exactly the https mode.

I don't think so. My proposed change only affects manually entered urls without protocol/schema. HTTP urls (entered manually or from links) would still work as expected, while https mode blocks them. I believe this change is small enough that they can make it the default, while http mode will likely remain optional for several years.

Re: Firefox 83 introduces HTTPS-Only Mode

#309

Post by GoblinSlayer »

iso1631 wrote: post #194
nine_k wrote: post #170

Earlier quoted context omitted.

If only the OS could terminate TLS and allow to filter decrypted traffic locally.

I was thinking more of devices I don't control - IOT stuff that requires internet access to function (like a box to watch netflix). Clearly anything running on my machine is fine as it's under my control

Just point them to your http proxy and filter there all you want.

Re: Firefox 83 introduces HTTPS-Only Mode

#310

Post by Spivak »

shawnz wrote: post #199
2ion wrote: post #163

Earlier quoted context omitted.

> The cat is out the bag, so to speak. I foresee a lot of adware, spyware, and malware leveraging DoH now to evade just about every DNS-based monitoring/blocking/provisioning solutions. But tunnelling X in Y is not new at all and has a long tradition (even in regular protocol design). Is this really a shift waiting to happen in malware? As I would think, this has been available all along. Except for browser-based mal…

Right. It is ridiculous to say that DoH enables malware because it has always been trivial to bypass DNS-based access control with or without technologies like DoH. In fact, if anything, using DoH would be a particularly cumbersome way of doing it when there are many simpler solutions. Like for example, just putting an IP in a text file on a REST endpoint.

I think the best case I can make is that it's not about the ability to tunnel DNS, it's that there's now many fast highly-available public DoH resolvers that bypass DNS filtering for free. A hypothetical malware author just needs to use any of them rather than set up their own tunnel.
Post reply on HN