Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 83 introduces HTTPS-Only Mode

blog.mozilla.org

Post reply on HN
Print view View original

421–430 of 525 posts

Re: Firefox 83 introduces HTTPS-Only Mode

#421

Post by hedora »

TheRealPomax wrote: post #419
iso1631 wrote: post #87

Earlier quoted context omitted.

I want my OS to do DNS - including DOH, not my browser. I want a single source for my DNS I want my network to tell me a DNS server to use. As I own my computer I can override that, but much of the time I want to use the network provided DNS server.

Cool, that makes you one of the people that's going to keep DoH turned off. What's the problem?

The internet of crap will also use DoH and bypass my network settings.

Also, it is only a matter of time before ads (and websites) start using it to bypass browser DNS:

https://github.com/byu-imaal/dohjs

Re: Firefox 83 introduces HTTPS-Only Mode

#422

Post by shawnz »

bscphil wrote: post #300
manquer wrote: post #135

Earlier quoted context omitted.

You are able to run own network and have the know how to do so, typical physical Firefox users cannot. Given your knowledge you can disable or even build firefox with DoH disabled , it is a sensible default for vast majority of users who do not know what DHCP is, or control their network. It cannotis trivial configuration for people who can control and do not want the DoH service provider given by Firefox. Also many…

> Given your knowledge you can disable or even build firefox with DoH disabled , it is a sensible default for vast majority of users who do not know what DHCP is, or control their network. It cannotis trivial configuration for people who can control and do not want the DoH service provider given by Firefox. I have mixed feelings about the issue, but it's not that simple. I run a variety of services on my LAN for my u…

The default behaviour is to fallback to the network DNS if DoH doesn't resolve the domain, so your use case would work fine.

archive.is didn't work for Cloudflare users because they purposely sabotaged the results for Cloudflare (they did actually return valid, but wrong, results).

EDIT: Although you might have a problem if the owners of the ".music" TLD decide to put something else there.

Re: Firefox 83 introduces HTTPS-Only Mode

#423

Post by shawnz »

manquer wrote: post #408
iso1631 wrote: post #231

Earlier quoted context omitted.

Yes, which is why my VPNs are available on port 443 and 53, including a TLS based VPN. Now port 53 can and often is intercepted (but sometimes it gets through when 443 doesnt)

it does not matter under what port including 443 you are running the service, deep packet inspection (DPI) can sniff out VPN traffic, perhaps you may not encountered this type of firewall as it somewhat more expensive to run both computationally and licensing wise. It is not possible to sniff out DoH traffic via DPI as looks exactly the same as regular traffic While running flash servers for media use in corporate en…

You can use an HTTPS "CONNECT" proxy to protect your VPN traffic in the same way (I assume that's the kind of setup they were referring to on port 443)

Re: Firefox 83 introduces HTTPS-Only Mode

#424

Post by JoshTriplett »

pbhjpbhj wrote: post #370
manquer wrote: post #135

Earlier quoted context omitted.

You are able to run own network and have the know how to do so, typical physical Firefox users cannot. Given your knowledge you can disable or even build firefox with DoH disabled , it is a sensible default for vast majority of users who do not know what DHCP is, or control their network. It cannotis trivial configuration for people who can control and do not want the DoH service provider given by Firefox. Also many…

Why should Firefox want enable users and devices to bypass network owners configuration in this way? A company should control their network, just as a home network's owner should have control.

For the vast majority of people, "the network" is their ISP or a random hotspot, who should absolutely be treated as a hostile adversary.

Re: Firefox 83 introduces HTTPS-Only Mode

#425

Post by robertlagrant »

perryizgr8 wrote: post #292
robertlagrant wrote: post #239

Earlier quoted context omitted.

> Am I supposed to trust them more than some man-in-the-middle just because they own a domain name? You can be assured that you are actually talking to them. That's a big step up from not being able to do that.

Depends on the content of the website. A lot of websites wouldn't benefit at all from that assurance. A lot of blogs and random personal projects come to mind. My own blog does not care about authentication or MITM at all. It would be just an unnecessary complexity without any benefit.

It's not the websites that get that assurance. Maybe read up on it.

Re: Firefox 83 introduces HTTPS-Only Mode

#426

Post by Barrin92 »

Karunamon wrote: post #272
taftster wrote: post #267

Earlier quoted context omitted.

Honest question. How is this feature enabling increased corporate/government control?

Because now almost every Firefox user will be sending their DNS straight to one centralized provider, a large corporation, which makes them more vulnerable to various kinds of government interference.

No offence, but how is that more centralised than all of your traffic being plainly visible to your ISP, which in many countries cooperate fairly closely with law enforcement and government, if they're not straight up government owned depending on what country you're in? For example in the UK, a fairly liberal country, DoH still is very useful to avoid countless of the ISP level content blocking that happens, not to mention if you're in a place like Russia.

For most users on the planet Cloudflare is a hell of a lot better than your ISP

Re: Firefox 83 introduces HTTPS-Only Mode

#427

Post by hsbauauvhabzb »

dingaling wrote: post #174
hsbauauvhabzb wrote: post #72

Earlier quoted context omitted.

If my choices are to implement a security control which forces a layer of security, or forgo that security control so Alice can upload her Holiday pictures to a host which doesn’t support HTTPS either, I know which one I’ll pick. Alice should either host her photos on Instagram, or learn how to run letsencrypt. The day where certs are no longer freely obtainable is the day another self governed free TLS provider will…

> Alice should either host her photos on Instagram, or learn how to run letsencrypt. Both leading to further centralisation of the Internet. > by providing installers to inject CAs into system cert stores That's already pointless on Android, user-installed CAs are ignored by default unless an app developer opts in to using them. Once we go down this path there's no turning back to the user-centric Web of the 1990s /…

> That's already pointless on Android, user-installed CAs are ignored by default unless an app developer opts in to using them.

And? App developers should opt in to ignoring transport security. I’m sure a bunch of Android shitware attempts to install CAs either via user interaction or exploitation.

> Once we go down this path there's no turning back to the user-centric Web of the 1990s / 2000s

The landscape we live in now is very different to then. I’m all for a free web, but not at the cost of security. The web is now a multi billion trillion dollar industry. Weakening security just so Bob can see Alices’ holiday pics in situation where Alice can’t figure out letsencrypt, is frankly unhinged.

If you want a ‘free web’ you’re welcome to disable any HTTPS enforcement and disable TLS cert checking entirely. Hell, fork a browser, be very clear about the security weaknesses and publish on github if you feel that strongly, I’ll even star it for you.

Re: Firefox 83 introduces HTTPS-Only Mode

#428

Post by shawnz »

Karunamon wrote: post #270
rhubinak wrote: post #209

Earlier quoted context omitted.

Easily doable (at least for the browser): https://support.mozilla.org/en-US/kb/canary-domain-use-appli...

So now I have to add fake DNS records for every application that decides to do their own special snowflake thing and ignore the source of truth for what DNS server to use? Oh joy. I run DHCP for a reason. That reason is telling devices on my network what their settings should be. I expect those settings to be honored, not them doing the electronic equivalent of "okay boomer" and using whatever arbitrary settings they…

The reason to run DHCP is to allow devices to be configured automatically, not to restrict how they can be configured.

Re: Firefox 83 introduces HTTPS-Only Mode

#429

Post by thamer »

abraxaz wrote: post #34

Great to see this built into firefox, I have been using HTTPS Everywhere https://www.eff.org/https-everywhere to achieve similar results, it won't warn you if it is not https (i think) but it will try and upgrade to https if it can. It is available for chrome and firefox. What particularly annoyed me was using http to sites which supported https.

The Brave browser has this feature built-in, by the way (Settings > Shields > Upgrade connections to HTTPS [X])

Re: Firefox 83 introduces HTTPS-Only Mode

#430

Post by jefftk »

vbezhenar wrote: post #368
ozim wrote: post #240

Earlier quoted context omitted.

First link, Kazakhstan even tried to MITM people with HTTPS, second injecting ads by ISP. [1] https://www.privateinternetaccess.com/blog/kazakhstan-tries-... [2] https://security.stackexchange.com/questions/157828/my-isp-b...

Kazakhstan did not do that to inject ads. I believe that they wanted to block webpages on a granular level (for example some specific blogs). Right now they block complete websites, because it's not possible to find out which URL user is visiting.

I read your parent as giving two separate examples.
Post reply on HN