Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 83 introduces HTTPS-Only Mode

blog.mozilla.org

Post reply on HN
Print view View original

381–390 of 525 posts

Re: Firefox 83 introduces HTTPS-Only Mode

#381

Post by snazz »

jevgeni wrote: post #221
dewey wrote: post #79

Earlier quoted context omitted.

What makes it more expensive? A certificate is free (With LE or self-signed), the performance impact is negligible and there's a clear reason for why everyone should be using it.

You cannot say that certificates are reliably free (especially in the long run), if there's only one entity providing them and that entity is dependent on corporate sponsors.

Tons of major websites rely on Let's Encrypt, so I think it's fair to say that they're probably not going anywhere soon. Free certificates are now standard on services like Cloudflare and Google App Engine. I think that AWS can generate free ones too.

Re: Firefox 83 introduces HTTPS-Only Mode

#382

Post by ryan29 »

iso1631 wrote: post #230
tialaramex wrote: post #222

Earlier quoted context omitted.

Just checked this yup. If I go to https://neverssl.com/ I get a warning explaining that this site doesn't have a certificate for neverssl.com but only for Cloudfront (presumably where it's hosted) But if I try to go to http://neverssl.com/ then I get the message explaining that the HTTPS site doesn't work, do I want the insecure HTTP one instead?

If I specify http://whatever.com in the address bar, or if I follow a link to http://whatever.com , I'd expect it to attempt to connect to port 80 on whatever.com, and not redirect to https unless the page responds with a Location header If I type "whatever.com", I'm happy with it to try port 443 first I'm not sure if a http/80 page should be at least HEADed to see if there's a redirect to https/443 before throwing u…

Many users don't know the difference between http and https, so if you're trying to get them redirected to a captive portal page it's a lot easier if the default is http.

Re: Firefox 83 introduces HTTPS-Only Mode

#383

Post by josephcsible »

pbhjpbhj wrote: post #367
josephcsible wrote: post #301

Earlier quoted context omitted.

What you want would make censorship and surveillance easier against the vast majority of people. Networks I'm on shouldn't be able to tell which CloudFlare-hosted site I'm visiting, or to block some of them without blocking them all. Letting the network give me a DNS resolver instead of using a known-good one would allow exactly those bad things.

OK, what if you own the network? The corollary to that is 'you shouldn't be allowed to stop devices on your network from accessing malware, or exfiltrating data'.

Untrusted devices should be on a separate network where they don't have access to any data worth exfiltrating.

Re: Firefox 83 introduces HTTPS-Only Mode

#384

Post by ric2b »

cat199 wrote: post #216
jorl17 wrote: post #188

Earlier quoted context omitted.

The main problem with keeping sites http is that someone in the middle can modify the content and inject arbitrary code, be it ads, crypto mining or just a redirect to a worse website. Therefore I believe it should be a social duty to make everything https so as to ensure that we don’t create something that can be used to harm others. I didn’t use to think like this until I actually tried it out by going to a mall an…

there is a middle ground of authenticating traffic without encrypting it - c.f. IPSEC AH mode - granted this type of thing isn't in HTTP but easily could be

What would be the advantage of that? Saving a few CPU cycles, maybe?

Re: Firefox 83 introduces HTTPS-Only Mode

#385

Post by ric2b »

doublerabbit wrote: post #220
jorl17 wrote: post #188

Earlier quoted context omitted.

The main problem with keeping sites http is that someone in the middle can modify the content and inject arbitrary code, be it ads, crypto mining or just a redirect to a worse website. Therefore I believe it should be a social duty to make everything https so as to ensure that we don’t create something that can be used to harm others. I didn’t use to think like this until I actually tried it out by going to a mall an…

> The main problem with keeping sites http is that someone in the middle can modify the content and inject arbitrary code I keep hearing this as a plausible excuse, yet I've never seen any proof of such. non-https does make it possible but has anyone got any source where someone has been victim of such attacks?

I did it myself for fun while I was in high-school, it's quite a trivial thing actually.

Just need to be on the same network as the victim and do some ARP spoofing to make your computer the gateway for that network.

Re: Firefox 83 introduces HTTPS-Only Mode

#386

Post by kazinator »

What I don't understand is why there isn't a simple button when you land into a HTTP page to switch to HTTPS.

In the browser bar, to the left the address, you get an icon of a padlock, with a red slashed circle across it, and the word "Not secure".

Why can't you click on this to get a popup to switch to trying the HTTPS version of the URL?

You can click on it, you get to a read-only tree of information providing info about the site.

If you right click on it, you get a context menu popup about customizing the toolbar.

Re: Firefox 83 introduces HTTPS-Only Mode

#387

Post by ryan29 »

stephen_g wrote: post #75
mittermayr wrote: post #40

Earlier quoted context omitted.

An alternative I use is http://captive.apple.com (other OS vendors have their own). Which may have a higher chance of being detected by the portal (more likely to be white-listed) and triggering the prompt correctly.

Frustratingly it doesn’t always work that way - one I have seen that is just bizarre is Qantas inflight wifi. It actually allows captive.apple.com to bypass the captive portal, so your iPhone, iPad or Mac thinks it has internet access. So you try to navigate to a page or use an app and just hit HTTPS certificate errors! So you have to think of some other site that is only HTTP or get the information card and enter th…

Like the sibling post said, you're probably seeing certificate errors caused by the portal, not traffic being allowed to captive.apple.com.

With http, a captive portal system will intercept your connection and redirect you to the portal authentication page. Most modern devices deal with it automatically by checking those plain http urls when the network comes up. For example, I think the way it works on iOS is that when you connect to a WiFi network the OS tries to hit http://captive.apple.com which triggers the redirect and prompts you for authentication.

With https, there's no way to have a valid TLS certificate for a random site the user is connecting to (ex: captive.apple.com), so you get a TLS error if you're attempting to connect to an https site while the portal is trying to redirect you for authentication.

Re: Firefox 83 introduces HTTPS-Only Mode

#388

Post by ryan29 »

tialaramex wrote: post #222
iso1631 wrote: post #103

Earlier quoted context omitted.

It will say "this website doesn't support https, do you want to connect anyway"

Just checked this yup. If I go to https://neverssl.com/ I get a warning explaining that this site doesn't have a certificate for neverssl.com but only for Cloudfront (presumably where it's hosted) But if I try to go to http://neverssl.com/ then I get the message explaining that the HTTPS site doesn't work, do I want the insecure HTTP one instead?

That kind of sucks because if a user misses the initial OS redirect for a captive portal login, the easiest way to get them back to the authentication page is to have them hit an http site. However, things like HSTS make that really hard to do without having a site that does NOT use https and defaulting to https is like having HSTS triggered on every site.

Having to tell them to click through a non-https warning is almost as bad as having to tell them to click through a TLS warning.

Re: Firefox 83 introduces HTTPS-Only Mode

#389

Post by kazinator »

iso1631 wrote: post #87
jchw wrote: post #18

I’m surprised at the negative knee-jerk reaction. I actually love this idea immediately. It encapsulates something I kind of already wanted when using HTTPS Everywhere. This doesn’t guarantee the transport is end-to-end secure; I’m sure plenty will strip the encryption at an LB and then possibly send it back over the internet. But, I think it’s a good addition nevertheless. Here’s to hoping for more DoH and encrypted…

I want my OS to do DNS - including DOH, not my browser. I want a single source for my DNS I want my network to tell me a DNS server to use. As I own my computer I can override that, but much of the time I want to use the network provided DNS server.

Sometimes you don't own the computer on which the browser is running, e.g. public web browsing kiosk. Or else you sort of own the computer, but not the DNS.

If you work in a setting in which web surfing is intercepted, and outright breaks pages, the in-browser DNS can be a godsend.

Re: Firefox 83 introduces HTTPS-Only Mode

#390

Post by ric2b »

superkuh wrote: post #377
Jaruzel wrote: post #118

awww crap - I've got loads of low-traffic websites that don't need https[1] that I'm now going to have to spend time sorting out certificates for. To be honest, it's about time that cert enablement is built into all web server configs (on all OSs) as a native feature instead of having to manually roll the config using this-weeks-currently-preferred letsencrypt script. --- [1] Yes, yes, I know everyone on HN prefers e…

This is incredibly bad for the health of the web. In kneejerk response to the invasion of privacy from world governments we're handing absolute control of the web back to those very governments. Everyone being forced to get permission from a centralized cert authority that is easily influenced, pressured, etc in order to host a visitable website is the end of the web as we know it. This is a slide into a total loss o…

I think you misunderstand how HTTPS works, there's no central root CS, nothing stops you from adding other trusted root certificate authorities.

In fact, your browser trusts a few dozens of different ones, and companies routinely manage their own.

Post reply on HN