Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 83 introduces HTTPS-Only Mode

blog.mozilla.org

Post reply on HN
Print view View original

331–340 of 525 posts

Re: Firefox 83 introduces HTTPS-Only Mode

#331

Post by palominoz »

ainiriand wrote: post #149
palominoz wrote: post #144

I hope they aren't going to force users in https-only in the future. Software shouldn't cut off legacy content (old websites that aren't going to be upgraded with https) something just because in theory it is more secure. If someone is surfing the web as an adult he is responsible of himself. Other than this there are historical components (web firewalls) that aren't going to work anymore .. so security is a matter w…

The feature has an allow-list so you can configure your sites the way you want.

yes, my statement was "i hope they aren't going to force this for everyone in the future"

Re: Firefox 83 introduces HTTPS-Only Mode

#332

Post by acd10j »

livre wrote: post #171
amenod wrote: post #156

Earlier quoted context omitted.

How can DNS be "full of spyware"? Or are you saying that it is used for spying on you? But anyway, it is your decision to use them - you can use 1.1.1.1 (CloudFlare), 8.8.8.8 (Google - if you don't mind the tracking) or any other DNS provider.

I don't know what GP meant with "full of spyware" but the most popular ISP in my region (Telefónica) used to redirect to pages filled with ads when a domain couldn't be resolved. Changing to 8.8.8.8 wouldn't work because it was unencrypted, they intercepted the requests and still redirected to ads. They stopped doing it some time ago but any ISP or middle man has the ability to continue doing that if they want.

Yes this is the same thing that happens with me, all unencrypted websites are redirected to adware. On phone i use 1.1.1.1 app from cloudfare but on other devices this is still issue.

Re: Firefox 83 introduces HTTPS-Only Mode

#333

Post by shadowgovt »

userbinator wrote: post #258
jorl17 wrote: post #188

Earlier quoted context omitted.

The main problem with keeping sites http is that someone in the middle can modify the content and inject arbitrary code, be it ads, crypto mining or just a redirect to a worse website. Therefore I believe it should be a social duty to make everything https so as to ensure that we don’t create something that can be used to harm others. I didn’t use to think like this until I actually tried it out by going to a mall an…

Therefore I believe it should be a social duty to make everything https so as to ensure that we don’t create something that can be used to harm others. Those who give up freedom for security deserve neither.

That quote is often taken badly out of context.

Benjamin Franklin, to the legislature of Pennsylvania, on the topic of basically letting the Penn family buy their way out of paying taxes indefinitely by providing enough hired mercenaries to protect the colony's frontier during the French and Indian war.

The freedom he was talking about was a legislature's freedom to govern.

The temporary security he was talking about was hired guns.

And none of it applies to the question of the tragedy of the commons that is "HTTP protocol is default embarrassingly insecure."

Indeed, if I were to torture the quote enough to make it fit, it looks more like "Those who would give up essential Liberty (Mozilla, in this case, to design the user agent the way they think best benefits their users and the World Wide Web as a whole) to purchase a little temporary Safety (... of their user count by delaying inconveniencing users in the corner cases where HTTPS can't be used), deserve neither Liberty nor Safety." But it barely fits.

Re: Firefox 83 introduces HTTPS-Only Mode

#334

Post by maxk42 »

josephcsible wrote: post #276
at_a_remove wrote: post #250

Once this sort of thing is widely accepted, we'll see various blogs and websites silenced by having a certificate revoked. Not right away but soon enough. It's a very exciting development. It's managed to use the geek "Everything has to be like this! " fanaticism to drag in a mechanism of control. I wonder which of the Four Horsemen it will be used against first.

There's a ton of trusted roots across multiple countries. I think the odds are virtually nil that none of them would let you have a certificate.

Certain governments already require their root beer the only one trusted by software in their country.

Re: Firefox 83 introduces HTTPS-Only Mode

#335

Post by shadowgovt »

wildfire wrote: post #295
josephcsible wrote: post #273

Earlier quoted context omitted.

Nobody's saying you should be required by law to use HTTPS. Voting is a social duty too and it's not mandatory.

The world would be a better place if voting was mandatory ( like it is in Australia ).

Agree to disagree. I've met enough Americans to believe that if we made voting mandatory, we'd just end up with Optimus Prime at the top of the ticket.

You can make an act compulsory on the whole population but you can't legislate duty-of-care upon the whole population.

Re: Firefox 83 introduces HTTPS-Only Mode

#336

Post by wang_li »

Karunamon wrote: post #270
rhubinak wrote: post #209

Earlier quoted context omitted.

Easily doable (at least for the browser): https://support.mozilla.org/en-US/kb/canary-domain-use-appli...

So now I have to add fake DNS records for every application that decides to do their own special snowflake thing and ignore the source of truth for what DNS server to use? Oh joy. I run DHCP for a reason. That reason is telling devices on my network what their settings should be. I expect those settings to be honored, not them doing the electronic equivalent of "okay boomer" and using whatever arbitrary settings they…

Software and hardware vendors need to start honoring the local configuration choices of the owner of the hardware and network. At a certain point ignoring my decisions about what can traverse my network becomes a crime and should be prosecuted as such.

Re: Firefox 83 introduces HTTPS-Only Mode

#337

Post by emn13 »

cptskippy wrote: post #289
emn13 wrote: post #236

Earlier quoted context omitted.

I don't understand this criticism at all; could you clarify what the issue is? None of this - DoH, nor HTTPS-only - is required. It's not even on by default (yet). If you have some specific wishes; it's trivial to pick a different DNS system, or leave https-only off. Additionally, DoH and https-only aren't really closed or locked in in any way. There's a cloudflare-base DoH option that's used by default, but just as…

> None of this - DoH, nor HTTPS-only - is required. It's not even on by default (yet). I had to disable DoH on all 5 of my machines because it was enabled automatically. > You mention pihole; and though I've never used it, they do have a page on DoH pihole supports using Cloudflare as an upstream DoH provider, not acting as a DoH provider.

> I had to disable DoH on all 5 of my machines because it was enabled automatically.

Some googling: it's on by default in the US now, not yet globally.

> pihole supports using Cloudflare as an upstream DoH provider, not acting as a DoH provider.

That's unfortunate; are you sure it's not just a little poorly documentend? At least the underlying software they link to https://developers.cloudflare.com/1.1.1.1/dns-over-https/clo... clearly mentions a proxy functionality, but maybe that's not on yet?

In any case: the point is that just as DNS proxying became easier over time, so will DoH proxying. There's nothing wrong with sticking to old tech as you chose to if it's not yet convenient for you to switch; especially if pihole supports upstream DoH, since presumably you trust the network between your device and your pihole ;-) - rendering the rest of the DoH benefits moot.

I'm sure time will resolve issues like that, but in the meantime, the vast majority of people that didn't customize their DNS and don't choose at all, or choose based on privacy or performance get a more private & secure option by default. I mean, it's transition pains are annoying, but it sounds like a good idea in general, so I suppose the transition costs are worth it in the long run, especially since the vast majority of users won't even notice. It's annoying to be in the camp that gets to bear the burden, for sure.

Re: Firefox 83 introduces HTTPS-Only Mode

#338

Post by ori_b »

shawnz wrote: post #330
ori_b wrote: post #325

Earlier quoted context omitted.

As a user, what is the increased administration burden for http? Are you referring to the whole CA system being an untrustworthy racket?

As a user, what is the increased admin burden for using DoH, assuming you don't want to implement network level content blocking? Basically none. What is the burden for using HTTPS assuming you DO want to be able to inspect and block HTTPS resources at a network level? Very extensive compared to plain HTTP.

Make the libc resolver do DoH, and drop it from firefox,half the problems go away.

The other half of the problems are around defaulting to allowing cloudflare to inspect your traffic, instead of comcast. And the lack of integrity and encryption for the rest of the DNS infrastructure. And the expansion of the complex and difficult to secure x509 certificate regime which we should be moving away from. (Something like gossamer seems to be a big step in the right direction)

I want encrypted dns, just not a half-assed hack of an implementation that is going to be impossible to fix once deployed.

Re: Firefox 83 introduces HTTPS-Only Mode

#339

Post by wang_li »

new23d wrote: post #262
cat199 wrote: post #214

Earlier quoted context omitted.

this breaks caching of simple objects that do not require content security

From intermediate (MITM) caches, yes. But end-clients can still cache it though. Our market is more backend API traffic so doesn't impact as much.

Since it's becoming harder and harder to implement transparent proxies and caches, someone should define a local cache protocol so that network administrators can configure explicit shared caches for the devices on their networks.

Re: Firefox 83 introduces HTTPS-Only Mode

#340

Post by oliveiracwb »

Where you see security, I see control. A way to commoditize the launch of ideas and information. Maybe 30 years from now, they will not prohibit any type of communication that is not properly licensed and standardized. As they do with commercial imports and exports. In Brazil today when you buy a product from another state of the federation, the tax goes partly to the origin of the product shipped and partly to the destination where it is purchased.
Post reply on HN