Firefox 83 introduces HTTPS-Only Mode • Hacker News Board

Re: Firefox 83 introduces HTTPS-Only Mode

#351

Post by josephcsible » Tue, Nov 17, 2020, 4:33 PM UTC

iso1631 wrote: post #346

josephcsible wrote: post #301

Earlier quoted context omitted.

What you want would make censorship and surveillance easier against the vast majority of people. Networks I'm on shouldn't be able to tell which CloudFlare-hosted site I'm visiting, or to block some of them without blocking them all. Letting the network give me a DNS resolver instead of using a known-good one would allow exactly those bad things.

So you are suggesting we further centralising the web to avoid censorship and surveilance?

How is this further centralising the Web? You can still use whatever DoH provider you want (and there's plenty of them); the choice just shouldn't be tied to the network you're on.

Re: Firefox 83 introduces HTTPS-Only Mode

#352

Post by Karunamon » Tue, Nov 17, 2020, 4:45 PM UTC

danShumway wrote: post #319

Karunamon wrote: post #272

Earlier quoted context omitted.

Because now almost every Firefox user will be sending their DNS straight to one centralized provider, a large corporation, which makes them more vulnerable to various kinds of government interference.

There is nothing about DNS over HTTPS that requires you to use one centralized provider, and unencrypted DNS has always been easier for large corporations, ISPs, and the government to sniff. I think people are just totally off-base on this. The instances of government/corporation reactions to DOH that we have seen suggest that untrustworthy organizations and governments largely oppose the change. They would not oppos…

Firefox made DoH to Cloudflare the default, right?

This is not responsive to my argument that it will impact most Firefox users. Most people won't change their defaults. Defaults matter. And that goes double when you need to dink with your own DNS server to override this crap.

Re: Firefox 83 introduces HTTPS-Only Mode

#353

Post by StavrosK » Tue, Nov 17, 2020, 4:46 PM UTC

oliveiracwb wrote: post #340

Where you see security, I see control. A way to commoditize the launch of ideas and information. Maybe 30 years from now, they will not prohibit any type of communication that is not properly licensed and standardized. As they do with commercial imports and exports. In Brazil today when you buy a product from another state of the federation, the tax goes partly to the origin of the product shipped and partly to the d…

How does that commoditize the launch of ideas and information?

Re: Firefox 83 introduces HTTPS-Only Mode

#354

Post by stonecharioteer » Tue, Nov 17, 2020, 4:47 PM UTC

jorl17 wrote: post #188

Jaruzel wrote: post #118

awww crap - I've got loads of low-traffic websites that don't need https[1] that I'm now going to have to spend time sorting out certificates for. To be honest, it's about time that cert enablement is built into all web server configs (on all OSs) as a native feature instead of having to manually roll the config using this-weeks-currently-preferred letsencrypt script. --- [1] Yes, yes, I know everyone on HN prefers e…

The main problem with keeping sites http is that someone in the middle can modify the content and inject arbitrary code, be it ads, crypto mining or just a redirect to a worse website. Therefore I believe it should be a social duty to make everything https so as to ensure that we don’t create something that can be used to harm others. I didn’t use to think like this until I actually tried it out by going to a mall an…

I've seen this said in several spots and I am curious. Could you point me to a resource that teaches me how to do this with a HTTP website please? I have no experience in doing this and am very interested to learn. Thanks in advance!

Re: Firefox 83 introduces HTTPS-Only Mode

#355

Post by dheera » Tue, Nov 17, 2020, 4:49 PM UTC

ignoramous wrote: post #151

iso1631 wrote: post #87

Earlier quoted context omitted.

I want my OS to do DNS - including DOH, not my browser. I want a single source for my DNS I want my network to tell me a DNS server to use. As I own my computer I can override that, but much of the time I want to use the network provided DNS server.

> I want my OS to do DNS - including DOH, not my browser. The cat is out the bag, so to speak. I foresee a lot of adware, spyware, and malware leveraging DoH now to evade just about every DNS-based monitoring/blocking/provisioning solutions. Anyway, the right layer to monitor for Internet traffic has always been the IP layer (VPNs notwithstanding).

I'm not fully understanding how this works. Can't the user just run their own secure DOH server and tell Firefox to use that instead?

Re: Firefox 83 introduces HTTPS-Only Mode

#356

Post by aeturnum » Tue, Nov 17, 2020, 4:51 PM UTC

stonecharioteer wrote: post #354

jorl17 wrote: post #188

Earlier quoted context omitted.

The main problem with keeping sites http is that someone in the middle can modify the content and inject arbitrary code, be it ads, crypto mining or just a redirect to a worse website. Therefore I believe it should be a social duty to make everything https so as to ensure that we don’t create something that can be used to harm others. I didn’t use to think like this until I actually tried it out by going to a mall an…

I've seen this said in several spots and I am curious. Could you point me to a resource that teaches me how to do this with a HTTP website please? I have no experience in doing this and am very interested to learn. Thanks in advance!

The answer to your question will depend on the set of technologies that you are using, but a great place to start is the EFF's Certbot[1]. Certbot will, for many common web servers, verify your servers' domain address and install a cert that will work for ~3 months. It's free and mostly automated.

I've been getting certs for all of my side projects and it takes about ~10 minutes each. Highly recommend.

[1] https://certbot.eff.org/

Re: Firefox 83 introduces HTTPS-Only Mode

#357

Post by josephcsible » Tue, Nov 17, 2020, 4:53 PM UTC

maxk42 wrote: post #334

josephcsible wrote: post #276

Earlier quoted context omitted.

There's a ton of trusted roots across multiple countries. I think the odds are virtually nil that none of them would let you have a certificate.

Certain governments already require their root beer the only one trusted by software in their country.

Which governments and which software?

Re: Firefox 83 introduces HTTPS-Only Mode

#358

Post by pbhjpbhj » Tue, Nov 17, 2020, 4:54 PM UTC

shawnz wrote: post #330

ori_b wrote: post #325

Earlier quoted context omitted.

As a user, what is the increased administration burden for http? Are you referring to the whole CA system being an untrustworthy racket?

As a user, what is the increased admin burden for using DoH, assuming you don't want to implement network level content blocking? Basically none. What is the burden for using HTTPS assuming you DO want to be able to inspect and block HTTPS resources at a network level? Very extensive compared to plain HTTP.

>assuming you don't want to implement network level content blocking? //

Who doesn't want that? I have a pihole (and use OpenDNS). Bypassed it all yesterday, as an experiment, to look at an anime site my eldest started using and immediately was hit with a pretty impressive and convincing phishing attempt (mimicking my ISP).

Pretty much all of us on HN seem to use some form of 'DNS' based filtering (pihole, or even just hosts file). UK ISPs offer DNS based filtering as a default (and have to filter some pages by law, and are encouraged to filter others [through threat of law]) ... but a lot of people want that, many many families, schools, businesses.

Certainly I don't want it to be easier for advertising and malware to bypass my chosen DNS-style filtering.

Re: Firefox 83 introduces HTTPS-Only Mode

#359

Post by aeturnum » Tue, Nov 17, 2020, 4:55 PM UTC

Like others, I'm not exactly inspired by this feature. I'm an advocate for HTTPS-everywhere, but I think we're quickly moving past the point of usefulness for most people.

On a personal level, as a developer, I actually find the ban on mixed connections on a web page much more frustrating. It's easy for me to get a cert for nginx for my side project. It's another thing entirely to figure out how to give my application server access to the certs in the "right" way so that the application can terminate wss:// connections. I have to figure it out, of course, because firefox will refuse to connect a ws:// connection on a https page.

Re: Firefox 83 introduces HTTPS-Only Mode

#360

Post by vbezhenar » Tue, Nov 17, 2020, 5:03 PM UTC

aeturnum wrote: post #359

Like others, I'm not exactly inspired by this feature. I'm an advocate for HTTPS-everywhere, but I think we're quickly moving past the point of usefulness for most people. On a personal level, as a developer, I actually find the ban on mixed connections on a web page much more frustrating. It's easy for me to get a cert for nginx for my side project. It's another thing entirely to figure out how to give my applicatio…

I don't understand your problem. Nginx should proxy all connections including websocket ones. Just don't expose your application server and use nginx as a reverse proxy.