31–40 of 463 posts
Side note: it beats me why browsers couldn’t agree a way to specify at least the first redirect in DNS, no web server needed for that part.
That makes a lot of sense. HTTPS adoption is now very high[1], and this might push it a little bit further for sites that don't redirect to HTTPS automatically. I've been using Firefox in the experimental HTTPS-only mode, and the web is quite usable without cleartext HTTP. [1] https://transparencyreport.google.com/https/overview It's not a big change from security perspective though. HTTP requests shouldn't be gettin…
I posted this in a separate comment and I will post it again.
https://certbot.eff.org/hosting_providers
HTTPS adoption is hard enough that the wast majority of shared hosting providers haven't automated cert provisioning and are delegating this process to their users.
The push towards forced HTTPS has significant costs, which most people in this filter bubble don't want to honestly discuss.
Is there a way to get exactly this new Chrome address bar behavior in Firefox? I.e. I want Firefox to follow plain http links same as before, but if I type in example.com it should expand to https://example.com
https://blog.mozilla.org/security/2020/11/17/firefox-83-intr...
That makes a lot of sense. HTTPS adoption is now very high[1], and this might push it a little bit further for sites that don't redirect to HTTPS automatically. I've been using Firefox in the experimental HTTPS-only mode, and the web is quite usable without cleartext HTTP. [1] https://transparencyreport.google.com/https/overview It's not a big change from security perspective though. HTTP requests shouldn't be gettin…
>HTTPS adoption is now very high[1] I posted this in a separate comment and I will post it again. https://certbot.eff.org/hosting_providers HTTPS adoption is hard enough that the wast majority of shared hosting providers haven't automated cert provisioning and are delegating this process to their users. The push towards forced HTTPS has significant costs, which most people in this filter bubble don't want to honestly…
Is there a way to get exactly this new Chrome address bar behavior in Firefox? I.e. I want Firefox to follow plain http links same as before, but if I type in example.com it should expand to https://example.com
That makes a lot of sense. HTTPS adoption is now very high[1], and this might push it a little bit further for sites that don't redirect to HTTPS automatically. I've been using Firefox in the experimental HTTPS-only mode, and the web is quite usable without cleartext HTTP. [1] https://transparencyreport.google.com/https/overview It's not a big change from security perspective though. HTTP requests shouldn't be gettin…
>HTTPS adoption is now very high[1] I posted this in a separate comment and I will post it again. https://certbot.eff.org/hosting_providers HTTPS adoption is hard enough that the wast majority of shared hosting providers haven't automated cert provisioning and are delegating this process to their users. The push towards forced HTTPS has significant costs, which most people in this filter bubble don't want to honestly…
HTTPS is old tech. "Let's Encrypt" is free.
Is there a way to get exactly this new Chrome address bar behavior in Firefox? I.e. I want Firefox to follow plain http links same as before, but if I type in example.com it should expand to https://example.com
Right, can it please stop hiding it though? URLs aren't prose
There's no link to more technical detail. What happens when the site I type in the URL bar doesn't support HTTPS? Will it error out? (with a timeout?) Or will it automatically fallback to trying HTTP? (In that case, could a MITM block HTTPS to force the browser to try to downgrade?) EDIT: I see that the article says it will fall back, but Chrome Canary has options in chrome://flags, and it's not clear which option th…
"For sites that don’t yet support HTTPS, Chrome will fall back to HTTP when the HTTPS attempt fails." MITM is still an issue. At some point I hope browsers can switch to "you have to type http:// if you want HTTP", and this is a step in that direction. (Disclosure: I work for Google, speaking only for myself)