Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 83 introduces HTTPS-Only Mode

blog.mozilla.org

Post reply on HN
Print view View original

491–500 of 525 posts

Re: Firefox 83 introduces HTTPS-Only Mode

#491

Post by kazinator »

minitech wrote: post #413
kazinator wrote: post #386

What I don't understand is why there isn't a simple button when you land into a HTTP page to switch to HTTPS. In the browser bar, to the left the address, you get an icon of a padlock, with a red slashed circle across it, and the word "Not secure". Why can't you click on this to get a popup to switch to trying the HTTPS version of the URL? You can click on it, you get to a read-only tree of information providing info…

Because that’s a lot of hidden UI for something people rarely want to do (be on an insecure version of a website while a secure version exists) and might not work and that they can still do relatively easily by typing ”s”.

The lot of hidden UI is already there; all it needs is one menu command.

There is UI for printing a page; I'm pretty sure I've adjusted a HTTP to HTTPS more times than I've printed a web page.

> still do relatively easily by typing ”s”.

You have to position the cursor first; it's annoying.

Re: Firefox 83 introduces HTTPS-Only Mode

#492

Post by shawnz »

lmm wrote: post #486
akerl_ wrote: post #347

Earlier quoted context omitted.

GitHub, PyPi, NPM, etc are all great options for hosting dynamic content from a fixed location which looks benign to scanning. For non-tech companies, replace with any relatively popular wiki. The goal is “make a connection over HTTPS or other normal-looking protocol, to a destination that is both justifiability relevant for normal user traffic and allows the attacker to seed the next-step”. And it turns out there ar…

> GitHub, PyPi, NPM, etc are all great options for hosting dynamic content from a fixed location which looks benign to scanning. They're not going to leave malware payloads sitting there. Pastebins etc. get abused as malware command-and-control systems all the time, and of course some gets through, but countermeasures happen. Whereas for a DoH server it would be operating as designed.

Domains can be seized too, nothing is foolproof.

Re: Firefox 83 introduces HTTPS-Only Mode

#493

Post by bilkow »

lmm wrote: post #486
akerl_ wrote: post #347

Earlier quoted context omitted.

GitHub, PyPi, NPM, etc are all great options for hosting dynamic content from a fixed location which looks benign to scanning. For non-tech companies, replace with any relatively popular wiki. The goal is “make a connection over HTTPS or other normal-looking protocol, to a destination that is both justifiability relevant for normal user traffic and allows the attacker to seed the next-step”. And it turns out there ar…

> GitHub, PyPi, NPM, etc are all great options for hosting dynamic content from a fixed location which looks benign to scanning. They're not going to leave malware payloads sitting there. Pastebins etc. get abused as malware command-and-control systems all the time, and of course some gets through, but countermeasures happen. Whereas for a DoH server it would be operating as designed.

> They're not going to leave malware payloads sitting there. They do though, I usually check where spam emails lead me to as a curiosity, and the payload is sometimes hosted on github.

A simple GET request to https://github.com/adkafdjsh20/cool_repo/blob/master/dns.txt would work for DNS purposes.

Also, there are countermeasures for malware domains themselves, as you can report them to registrars.

Re: Firefox 83 introduces HTTPS-Only Mode

#494

Post by hsbauauvhabzb »

CamperBob2 wrote: post #482
hsbauauvhabzb wrote: post #427

Earlier quoted context omitted.

> That's already pointless on Android, user-installed CAs are ignored by default unless an app developer opts in to using them. And? App developers should opt in to ignoring transport security. I’m sure a bunch of Android shitware attempts to install CAs either via user interaction or exploitation. > Once we go down this path there's no turning back to the user-centric Web of the 1990s / 2000s The landscape we live i…

The web is now a multi billion trillion dollar industry. Maybe your web service is, but mine isn't. Mine is a specialized embedded device server that now has an expiration date for no reason on God's green earth.

Feel free to fork Mozilla codebases if you disagree with fundamental security concepts.

Re: Firefox 83 introduces HTTPS-Only Mode

#495

Post by a1369209993 »

kibwen wrote: post #440
a1369209993 wrote: post #411

Earlier quoted context omitted.

Technically those options are trivial with a non-defective system like approval voting, but assuming you're stuck with first-past-the-post, that's pretty much correct.

Not quite, even with normal approval voting there's no way to distinguish between voters who want to say "all these options are undesirable and everything is broken" and those who want to say "life is good, I'm cool with whoever" and those whose votes get lost or obstructed. The reason why the notion of a "protest vote" is so pointless under our current system is specifically due to the indistinguishability of the fi…

What definition of "approval voting" are you using? I'm talking about a ballot where each candidate is marked "approve" or "reject". With that system, "all these options are undesirable and everything is broken" is reject-all, while "life is good, I'm cool with whoever" is approve-all (and lost or obstructed is obviously no ballot at all; there's not much you can do about that).

Re: Firefox 83 introduces HTTPS-Only Mode

#496

Post by st1ck »

abraxaz wrote: post #34

Great to see this built into firefox, I have been using HTTPS Everywhere https://www.eff.org/https-everywhere to achieve similar results, it won't warn you if it is not https (i think) but it will try and upgrade to https if it can. It is available for chrome and firefox. What particularly annoyed me was using http to sites which supported https.

As others pointed out, you can set it up to always upgrade to HTTPS and warn you when it's not supported. But that's not gonna work all the time: some websites will have self-signed certificates (which is better that nothing I guess), some will return 403 or 404 (for HTTPS only), some will just not load after trying for half a minute.

Re: Firefox 83 introduces HTTPS-Only Mode

#497

Post by afiori »

jacquesm wrote: post #167
afiori wrote: post #145

Earlier quoted context omitted.

I think it is deeper, the problem is that HTML tables are serialized in row and columns separately, so for example if you wanted a cell to be 2 rows tall and 2 columns wide there wasn't a local change that could allow it. To my understanding CSS Grid is meant to solve this

Yes there was: colspan.

thank for the correction, then my position is that with rowspan and colspan tables were sorta nice :)

Re: Firefox 83 introduces HTTPS-Only Mode

#498

Post by rakoo »

CamperBob2 wrote: post #484
rakoo wrote: post #73

Earlier quoted context omitted.

As a visitor to the website, how can I be sure it's only holiday pictures ? If I get to your friendly website and it asks me for private information, and I'm willing to give it because I trust you, what tells me only you will receive it ? How do I know it's your holiday pictures, and not some scam someone else wants to trick me into ?

Here's a novel idea: how about popping up scary warnings when an insecure site asks for information, as opposed to if the insecure site merely exists ? Static content does not need https unless there are reasons for privacy or MiTM concerns related to the nature of the content itself.

But you don't know if it's the real content. There's a problem even before entering information. What tells me it's your holiday pictures and not someone else's, and a person in the middle wants to tarnish your name ? What if your ISP/your hosting provider adds ads in the page, or a MiTM adds a link to a scam site ?

Re: Firefox 83 introduces HTTPS-Only Mode

#499

Post by emn13 »

cptskippy wrote: post #417
emn13 wrote: post #337

Earlier quoted context omitted.

> I had to disable DoH on all 5 of my machines because it was enabled automatically. Some googling: it's on by default in the US now, not yet globally. > pihole supports using Cloudflare as an upstream DoH provider, not acting as a DoH provider. That's unfortunate; are you sure it's not just a little poorly documentend? At least the underlying software they link to https://developers.cloudflare.com/1.1.1.1/dns-over-h…

My objection is that the change was made without notice or explicit permission, and changed the chain of trust. Mozilla decided that I should trust Cloudfare and that I should not trust my own network or the corporate network.

Yeah, the rollout (as opposed to the feature) sounds poor. Since I didn't experience this - you're saying you upgraded FF and without notice your DNS settings were replaced? I.e. anything only resolvable on your LAN suddenly stopped working? That's pretty annoying to debug!

Re: Firefox 83 introduces HTTPS-Only Mode

#500

Post by skissane »

nine_k wrote: post #170
iso1631 wrote: post #160

Earlier quoted context omitted.

I've always assumed any device or program I don't control will bypass anything I tell it to use and tunnel all it's evil traffic. It does feel the world is moving away from a multi-level network to run everything over TLS/TCP (and probably eventually mainly TLS/UDP), taking away the power from me as a network and device owner, and giving it to the developers

If only the OS could terminate TLS and allow to filter decrypted traffic locally.

IBM z/OS has an interesting feature: AT-TLS (Application Transparent TLS). An app uses the OS sockets API to create plaintext sockets, and the OS adds TLS to them (based on policies configured by the sysadmin) transparent to the application. (There are IOCTLs that apps can call to discover this is going on, turn it on/off, configure it, etc, but the whole idea is you can add TLS support to some legacy app without needing any code changes, so adding those IOCTL calls to your app is totally optional.)

In some parallel universe, TLS would have been part of TCP not a separate protocol and the Berkeley sockets implementation in the OS kernel would handle all encryption, certificate validation, etc, on behalf of applications. AT-TLS is a bit like visiting that parallel universe

Post reply on HN