Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HTTPS Everywhere will sunset in January 2023

eff.org

Post reply on HN
Print view View original

41–50 of 148 posts

Re: HTTPS Everywhere will sunset in January 2023

#41

Post by rav »

bombcar wrote: post #5
theandrewbailey wrote: post #3

That was a good extension for a specific time. I stopped using it about 5 years ago when everyone had been pushing HTTPS hard, and Let's Encrypt had become popular. I didn't notice any websites not using HTTPS, so I didn't look back.

http://neverssl.com remains for those badly-setup wifi networks.

Similar to HTTPS-only being built into web browsers, isn't captive portal detection built into all modern OSes? What's the badly-setup wifi network that requires you to open your browser but doesn't get detected properly by the OS as a captive portal?

Re: HTTPS Everywhere will sunset in January 2023

#42

Post by user3939382 »

Taywee wrote: post #4

This is the kind of sunset you love to see. Retirement because they succeeded and therefore became redundant, rather than due to failure. If there's one organization I love to see succeed, it's the EFF.

That’s how I used to feel until I found out they accepted millions in donations from companies like Google and Facebook/their executives/their executives’ charities.

I’m just some guy on the Internet but IMHO their being OK with massive conflicts of interest means I no longer trust them.

Re: HTTPS Everywhere will sunset in January 2023

#43

Post by necovek »

viraptor wrote: post #7
theandrewbailey wrote: post #3

That was a good extension for a specific time. I stopped using it about 5 years ago when everyone had been pushing HTTPS hard, and Let's Encrypt had become popular. I didn't notice any websites not using HTTPS, so I didn't look back.

There are still places that don't auto-redirect to https for some reason. Maybe a temporary misconfiguration. I just ran into http://www.mbsonline.gov.au today and was surprised it didn't redirect and has broken https, even though that org really shouldn't do that .

A redirect itself is considered bad by some because it encourages relying on http in the first place (imagine always hitting a web site through http and expecting a redirect instead of going to https directly).

As soon as you do that, you are similarly prone to MITM attacks: on an insecure network, you hit an http site and it replaces the redirect with one to a https site that looks like the same domain but really isn't (with a valid cert for mbsonline.gov.au.foo.io).

For my personal sites, I prefer to go with no redirects and if it really processes data, https-only.

For users, the right solution isfor browsers to always attempt https first even if those could be technically serving entirely different content (that would be one hell of an anti-pattern though, so I wouldn't worry about it).

Re: HTTPS Everywhere will sunset in January 2023

#44

Post by metacritic12 »

user3939382 wrote: post #42
Taywee wrote: post #4

This is the kind of sunset you love to see. Retirement because they succeeded and therefore became redundant, rather than due to failure. If there's one organization I love to see succeed, it's the EFF.

That’s how I used to feel until I found out they accepted millions in donations from companies like Google and Facebook/their executives/their executives’ charities. I’m just some guy on the Internet but IMHO their being OK with massive conflicts of interest means I no longer trust them.

Serious question: is there a popular charity that by rule doesn't accept donations from really rich people?

Re: HTTPS Everywhere will sunset in January 2023

#45

Post by notatoad »

rav wrote: post #41
bombcar wrote: post #5

Earlier quoted context omitted.

http://neverssl.com remains for those badly-setup wifi networks.

Similar to HTTPS-only being built into web browsers, isn't captive portal detection built into all modern OSes? What's the badly-setup wifi network that requires you to open your browser but doesn't get detected properly by the OS as a captive portal?

it isn't so much "badly" set up as maliciously set up. Captive portal vendors like to find ways of defeating the operating system's captive portal detection, because it hinders their ability to show ads after the captive portal login process.

Re: HTTPS Everywhere will sunset in January 2023

#46

Post by cmeacham98 »

ZWoz wrote: post #38
DANK_YACHT wrote: post #36

Earlier quoted context omitted.

The underlying assumption is that we're talking about the internet, not a private network, but even your private network would benefit from encryption. What is the benefit of having anyone with access to your network potentially read / modify your network traffic?

Browsers are being pretty weak to understand difference between local networks vs internet. Lot of times I have seen hassle caused by HTTPS, be it printer or server baseboard management controller.

Citation needed. Firefox HTTPS only mode does not upgrade local IP addresses or reserved local "TLDs" like .local. If machines on your "local network" are squatting on a public IP or potentially public domain name how is the browser supposed to know the difference?

Re: HTTPS Everywhere will sunset in January 2023

#47

Post by jacooper »

lapcat wrote: post #26

It doesn't seem to be mentioned by the EFF, but coincidentally, January 2023 is when Manifest v2 extensions stop working in Google Chrome: https://developer.chrome.com/blog/mv2-transition/

And its going to be a very big moment, since V3 effectively bans Adblockers and website redirect extensions.

It might increase Firefox adoption if it actually happens.

Re: HTTPS Everywhere will sunset in January 2023

#48

Post by leokennis »

Taywee wrote: post #4

This is the kind of sunset you love to see. Retirement because they succeeded and therefore became redundant, rather than due to failure. If there's one organization I love to see succeed, it's the EFF.

Plus:

* Long sunset period

* Instructions to make sure you can enjoy the same security after they sunset

Re: HTTPS Everywhere will sunset in January 2023

#49

Post by peoplefromibiza »

DANK_YACHT wrote: post #32
superkuh wrote: post #29

HTTPS Everywhere being available in browsers as an option is great. HTTPS Everywhere being promoted as something you should have on by default is bad. HTTPS, like much else, relies on incorporated entities as certificate authorities. And that's fine for commercial interactions and if browsers were only for interacting with businesses. But by a combination of centralization in a few CAs (everyone uses LetsEncrypt now)…

HTTP is not ok. Anyone can ready / modify what is being sent. This privacy intrusion will definitely happen, whereas the risk of being banned by "some external corporation" is low. And, you always have the option of self-signing your own certificate, which is at least as secure as using HTTP, and much more secure if you can verify the certificate via a side channel.

> HTTP is not ok

actually, it is.

HTTP is perfectly fine. [1]

> Anyone can ready / modify what is being sent

Anyone can break a window and enter my house.

But I haven't aired a private army to patroll the windows.

NSA can break HTTPS, TGF exists and China Trusted SSL Certificates are a thing.

False sense of security is often more dangerous than a real sense of insecurity.

Edit: [1] how many of you don't terminate SSL at load balancer?

Re: HTTPS Everywhere will sunset in January 2023

#50

Post by seiferteric »

ZWoz wrote: post #38
DANK_YACHT wrote: post #36

Earlier quoted context omitted.

The underlying assumption is that we're talking about the internet, not a private network, but even your private network would benefit from encryption. What is the benefit of having anyone with access to your network potentially read / modify your network traffic?

Browsers are being pretty weak to understand difference between local networks vs internet. Lot of times I have seen hassle caused by HTTPS, be it printer or server baseboard management controller.

An issue I don't think is addressed is how do you get a valid certificate for a server on a local network? Like setting a new device or router, you often type in the IP address (or maybe mDN name), then you either have to use http, or for https you get a warning and have to add an exception for an invalid certificate... How would one even solve this issue on a local network? I had an idea that I was thinking would be a cool RFC, have the router run a CA, then pass a DHCP (or RA) option with a local CA certificate for the end-user device to trust. Then services could request server certs from it (via ACME protocol). The issue though is that this gives too much power to the network operator. Imagine connecting to wifi at a coffee shop and they decide to MITM your google connections...
Post reply on HN