Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HTTPS Everywhere will sunset in January 2023

eff.org

Post reply on HN
Print view View original

81–90 of 148 posts

Re: HTTPS Everywhere will sunset in January 2023

#81

Post by renonce »

0xbadcafebee wrote: post #65
marcosdumay wrote: post #60

Earlier quoted context omitted.

That's a thing for local software to decide. It's also something that can be done with a level of reliability that will impress incredulous people. But that there will always be somebody to complain that is not following the standard recommendations.

In that case you don't need a certificate. Just check that the .local FQDN's IP is on a local network. 1. Look up all local interfaces' networks (IP & subnet mask) 2. Determine if .local IP is within subnet range of one of the interfaces 3. If .local IP is not on a subnet of a local interface, drop the connection This is still "host-based networking" and there's always the possibility a rogue network could be attache…

It's not practical to hide vendor keys. Unless the key is embedded in a security chip in factory it's usually possible to extract them from the firmware. Even if vendor CA is not compromised, stealing keys from a single device should be sufficient.

Re: HTTPS Everywhere will sunset in January 2023

#82

Post by renonce »

otabdeveloper4 wrote: post #70
da_chicken wrote: post #53

Earlier quoted context omitted.

Eh, kind of. It's successful as far as the Internet, which is great. But Internet web pages isn't everything. There's still a real issue with infrastructre that has web configuration. Everything from home routers to video cameras and so on. Not being able to ship with a certificate that passes browser security checks is a problem that essentially nobody has addressed. When people connect to an IOT device, they need t…

It's security theater, it's not meant to solve real problems for real people.

Since everyone is using HTTPS, the problem has been away for so long that you simply forgot it.

Re: HTTPS Everywhere will sunset in January 2023

#83

Post by bmm6o »

my69thaccount wrote: post #18
aaronmdjones wrote: post #17

Earlier quoted context omitted.

Debian ships with its own signing keys to authenticate the packages that it downloads. They are acting as their own CA. This isn't scalable to the web.

Whether or not it's scalable is orthogonal to the question. A browser would call Debian's repos insecure despite the fact that they are secure by other means. vv: whether it's authenticated by TLS or PGP is literally isomorphic except one is centralized to CAs and one is decentralized with web of trust. That's the only difference.

> Whether or not it's scalable is orthogonal to the question

If it's not scalable to the web then it's not a replacement for the current solution.

> whether it's authenticated by TLS or PGP is literally isomorphic

PGP is a viable solution in this scenario because there is a single organization that is signing a known set of packages. It doesn't provide confidentiality and can't authenticate arbitrary responses. A narrow use case that doesn't require a CA does not make a strong argument that CA's are unnecessary in general.

Re: HTTPS Everywhere will sunset in January 2023

#84

Post by [deleted] »

bombcar wrote: post #5
theandrewbailey wrote: post #3

That was a good extension for a specific time. I stopped using it about 5 years ago when everyone had been pushing HTTPS hard, and Let's Encrypt had become popular. I didn't notice any websites not using HTTPS, so I didn't look back.

http://neverssl.com remains for those badly-setup wifi networks.

[deleted]

Re: HTTPS Everywhere will sunset in January 2023

#85

Post by thebeardisred »

jwilk wrote: post #62
kevincox wrote: post #24

Earlier quoted context omitted.

The article talks about how to get this HTTPS by default functionality in all major browsers. I don't see how your complaint about not being redirected to HTTPS is relevant with those settings enabled.

There's still plenty of useful websites that are HTTP-only or that have HTTPS misconfigured. The HTTPS-only mode will break them, whereas HTTPS Everywhere just works.

+1. I was having this sort of issue setting up an Android tablet as a wifi CNC pendant. The controller is based on an ESP32 (which has limited storage for a full cert chain) and I run it without a gateway address on it's own VLAN. I'm certain it's "secure enough".

Turns out Android + Firefox mobile keeps trying to turn "http" to "https" and at the same time specifying the IP + port explicitly in the URL is considered malicious by Firefox.

"This address uses a network port which is normally used for purposes other than Web browsing. Firefox has canceled the request for your protection."

I had to run a development version of Firefox just to be able to get to "about:config" to disable the behavior.

Re: HTTPS Everywhere will sunset in January 2023

#86

Post by recursive »

Macha wrote: post #58
da_chicken wrote: post #53

Earlier quoted context omitted.

Eh, kind of. It's successful as far as the Internet, which is great. But Internet web pages isn't everything. There's still a real issue with infrastructre that has web configuration. Everything from home routers to video cameras and so on. Not being able to ship with a certificate that passes browser security checks is a problem that essentially nobody has addressed. When people connect to an IOT device, they need t…

Right, but that's not HTTPS Everywhere. HTTPS Everywhere was "this site already has HTTPS, and really should only use that, but doesn't, so we'll redirect you to the HTTPS version". Now sites that have HTTPS default to it, and browsers have options to basically try https first and see if it works.

Should have been called "HTTPS as long as its already there".

"HTTPS Everywhere" is pretty suggestive. And the English meaning of the words might be a worthwhile goal too.

Re: HTTPS Everywhere will sunset in January 2023

#87

Post by necovek »

marcosdumay wrote: post #61
necovek wrote: post #43

Earlier quoted context omitted.

A redirect itself is considered bad by some because it encourages relying on http in the first place (imagine always hitting a web site through http and expecting a redirect instead of going to https directly). As soon as you do that, you are similarly prone to MITM attacks: on an insecure network, you hit an http site and it replaces the redirect with one to a https site that looks like the same domain but really is…

A permanent redirection before setting the correct headers is the best you can do at the server side. Yes, the user is using insecure practices, and no, you can't correct it on your server.

I am arguing that the best you can do is not even have HTTP enabled.

A permanent redirect is the second best ;) And yeah, most practical for commercial entities (which is why I highlighted what I do for my personal sites).

Re: HTTPS Everywhere will sunset in January 2023

#88

Post by justaj »

Taywee wrote: post #4

This is the kind of sunset you love to see. Retirement because they succeeded and therefore became redundant, rather than due to failure. If there's one organization I love to see succeed, it's the EFF.

Not entirely.

They don't provide an alternative to "HTTPS Everywhere User Rules" as well as adding exceptions to HTTPS only sites (under "HTTPS Everywhere Sites Disabled"), which can be found in HTTPS Everywhere options.

In Chromium I can only turn HTTPS on all sites, without exception. It also doesn't allow me to have mixed content (on certain sites)

Re: HTTPS Everywhere will sunset in January 2023

#89

Post by 0xbadcafebee »

renonce wrote: post #81
0xbadcafebee wrote: post #65

Earlier quoted context omitted.

In that case you don't need a certificate. Just check that the .local FQDN's IP is on a local network. 1. Look up all local interfaces' networks (IP & subnet mask) 2. Determine if .local IP is within subnet range of one of the interfaces 3. If .local IP is not on a subnet of a local interface, drop the connection This is still "host-based networking" and there's always the possibility a rogue network could be attache…

It's not practical to hide vendor keys. Unless the key is embedded in a security chip in factory it's usually possible to extract them from the firmware. Even if vendor CA is not compromised, stealing keys from a single device should be sufficient.

I was thinking more along the lines of signature verification, but I forgot that any spoofed device could just supply a signature it got out of a device, so I think you're probably right.

Re: HTTPS Everywhere will sunset in January 2023

#90

Post by mmis1000 »

nullbytesmatter wrote: post #66
jacooper wrote: post #47

Earlier quoted context omitted.

And its going to be a very big moment, since V3 effectively bans Adblockers and website redirect extensions. It might increase Firefox adoption if it actually happens.

You do realize Firefox is going to V3 as well?

V3 and request modification banned are two different things. The chrome still support request modification in v3 but disallow extension to use it(only allow enterprise policy or whatever to enable it). While firefox don't have plans like this (so far).
Post reply on HN