Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 83 introduces HTTPS-Only Mode

blog.mozilla.org

Post reply on HN
Print view View original

511–520 of 525 posts

Re: Firefox 83 introduces HTTPS-Only Mode

#511

Post by dspillett »

iso1631 wrote: post #391
dspillett wrote: post #366

Earlier quoted context omitted.

All our internal services are HTTPS. Then if a new hack is found to weaken wireless protocols we have that extra line of protection. Security in depth. We serve strongly regulated industries and are subject to in-depth audits by clients on occasion, so perhaps my level of paranoia would be less warranted elsewhere. I'd still HTTPS everything though, even if the potential payoff is small because the required effort is…

public certificates? Do you use wildcards, or are you unconcerned by leaking information like servernames via CT?

Public wildcard cert for centrally managed things.

Of course only a trusted few have access to the private parts of the certificate that covers centrally managed things. For local dev instances I suggest having a local only meaningless domain and a wildcard off that,

If we were using per name certs and name leaking were a significant issue we could instead sign with a local CA and push the signing cert out as trusted to all machines we manage.

Re: Firefox 83 introduces HTTPS-Only Mode

#512

Post by tristor »

topranks wrote: post #456
tristor wrote: post #320

Earlier quoted context omitted.

I'm not sure why HN won't allow me to reply to ori_b's question below you, however DoH in Firefox (and in Chrome) have clearly spelled out ways to disable it at the network level for those folks who are network operators and want to restrict it due to interference in filtering or split-horizon DNS. https://support.mozilla.org/en-US/kb/configuring-networks-di... Someone previously mentioned Pi-Hole. Pi-Hole provides t…

The main thing I don’t want is to send all my browsing data to Cloudflare or similar “public” DNS operator outside my jurisdiction.

Currently, Firefox only has DoH rolled out in the US, so CloudFlare is in that same jurisdiction. Additionally, all DoH providers included in Firefox must meet the Trusted Recursive Resolver (TRR) guidelines, sign a contract to that effect, and undergo third-party audits to ensure they meet the requirements.

https://wiki.mozilla.org/Security/DOH-resolver-policy

This is all publicly documented. As Mozilla rolls DoH out to other regions they will add additional TRR partners and CloudFlare won't be the only choice.

Re: Firefox 83 introduces HTTPS-Only Mode

#513

Post by Ajedi32 »

makecheck wrote: post #509

One thing I’ve noticed in HTTPS mode is that sites where I used to lazily type "foobar.com" (resolving to "www.foobar.com" over HTTPS) do not necessarily auto-direct anymore, instead displaying the scary message first. Whereas, typing "www.foobar.com" directly does not trigger the message. I’m not sure where the auto-switch from "foobar.com" to "www.foobar.com" occurs; if it’s in the browser, ideally Firefox would at…

The redirect gets sent by the server. foobar.com and www.foobar.com are technically different domains, even if conventionally one should always redirect to the other.

Re: Firefox 83 introduces HTTPS-Only Mode

#514

Post by Ajedi32 »

acdha wrote: post #173
zajio1am wrote: post #158

Hot take: HTTPS-only mode is a bad idea if it is not paired with first-class support for self-signed certificates authorized using DANE+DNSSec. It just forces everyone to use broken/redundant CA model.

Can you articulate precisely the problem you believe this will solve? From my perspective it seems like it’s just making the system more fragile and harder to fix since DNSSEC requires OS updates to improve, while not meaningfully preventing state-level attacks.

Kinda off-topic, but I wonder if the adoption of DNS-over-HTTPS will eventually solve the ossification problem you're referring to by moving DNS resolution to the application level.

Re: Firefox 83 introduces HTTPS-Only Mode

#515

Post by acdha »

Ajedi32 wrote: post #514
acdha wrote: post #173

Earlier quoted context omitted.

Can you articulate precisely the problem you believe this will solve? From my perspective it seems like it’s just making the system more fragile and harder to fix since DNSSEC requires OS updates to improve, while not meaningfully preventing state-level attacks.

Kinda off-topic, but I wonder if the adoption of DNS-over-HTTPS will eventually solve the ossification problem you're referring to by moving DNS resolution to the application level.

It can definitely help since you're removing the network operator from the critical path. Large enterprises and ISPs are, not without reason, very conservative about breaking legacy clients but a browser vendor only has to worry about their own software in the release they ship DoH in (with some caveats they've addressed about internal split-view DNS, etc.) so they don't have to deal with complaints if, say, including an extra header breaks 5% of old IoT devices which haven't had an update in a decade.

Re: Firefox 83 introduces HTTPS-Only Mode

#516

Post by proactivesvcs »

CodesInChaos wrote: post #29

One change I'd like to see in browsers is when the user enters a domain without protocol in the url bar it interprets that as https instead of http.

I tried out the "HTTPS Everywhere" Firefox extension but found it cause me more trouble than it was worth, then found "HTTPS By Default" which suits my use much better. It automatically requests all awesomebar requests to https:// by default; one can manually use http:// to bypass it.

Re: Firefox 83 introduces HTTPS-Only Mode

#517

Post by skissane »

remexre wrote: post #510
skissane wrote: post #500

Earlier quoted context omitted.

IBM z/OS has an interesting feature: AT-TLS (Application Transparent TLS). An app uses the OS sockets API to create plaintext sockets, and the OS adds TLS to them (based on policies configured by the sysadmin) transparent to the application. (There are IOCTLs that apps can call to discover this is going on, turn it on/off, configure it, etc, but the whole idea is you can add TLS support to some legacy app without nee…

I think this is actually making a comeback for the server room; https://www.kernel.org/doc/html/latest/networking/tls.html for example. I _think_ the point of these is hardware TLS accelerators.

Linux kernel TLS, at least at the moment, only does the symmetric encryption part in the kernel, and the TLS handshake, certificate validation, has to be provided by user space. This is different from z/OS AT-TLS in which the OS does the TLS handshake, certificate validation, etc as well.

(Strictly speaking, I'm not sure if AT-TLS actually is implemented in the OS kernel – or "nucleus" to use the z/OS terminology – it may actually be implemented somewhere else, say in the C library. I know some of it is actually implemented by a daemon called PAGENT. But, from the application programmers viewpoint, it is provided by the OS, however exactly the OS provides it.)

Re: Firefox 83 introduces HTTPS-Only Mode

#518

Post by shawnz »

stonecharioteer wrote: post #489
aeturnum wrote: post #356

Earlier quoted context omitted.

The answer to your question will depend on the set of technologies that you are using, but a great place to start is the EFF's Certbot[1]. Certbot will, for many common web servers, verify your servers' domain address and install a cert that will work for ~3 months. It's free and mostly automated. I've been getting certs for all of my side projects and it takes about ~10 minutes each. Highly recommend. [1] https://ce…

Oh wait I didn't out across what I wanted. I meant how do I do a simple "attack" on a http website that's at a mall as OP said. I know how to use certbot for the certificates, (thank you Digital Ocean docs). I was wondering. If I run a simple http page on my home network, how can I, from another device, change it or make another client get a modified page with the same address?

I think they are referring to ARP cache poisoning.

Or maybe Wi-Fi promiscuous mode packet sniffing, but that's a read-only attack.

Re: Firefox 83 introduces HTTPS-Only Mode

#519

Post by 3np »

emn13 wrote: post #499
cptskippy wrote: post #417

Earlier quoted context omitted.

My objection is that the change was made without notice or explicit permission, and changed the chain of trust. Mozilla decided that I should trust Cloudfare and that I should not trust my own network or the corporate network.

Yeah, the rollout (as opposed to the feature) sounds poor. Since I didn't experience this - you're saying you upgraded FF and without notice your DNS settings were replaced? I.e. anything only resolvable on your LAN suddenly stopped working? That's pretty annoying to debug!

That's indeed what happened but only for US users.
Post reply on HN