Deprecating Non-Secure HTTP

#1

Post by talideon » Thu, Apr 30, 2015, 10:38 PM UTC

Deprecating Non-Secure HTTP
blog.mozilla.org

Re: Deprecating Non-Secure HTTP

#2

Post by rossng » Thu, Apr 30, 2015, 11:29 PM UTC

This is a pretty bold move, but I like the intent behind it. Hopefully Mozilla can pull it off without causing any problems for normal users.

Presumably it will all be synced with their plans to launch a free CA[1] in the near future.

[1] https://letsencrypt.org/

Re: Deprecating Non-Secure HTTP

#3

Post by chimeracoder » Thu, Apr 30, 2015, 11:31 PM UTC

I'm very glad to see this. It's embarrassing to think that, just a few years ago, many major websites used HTTP for all but their login pages, and it took Firesheep to get them into gear.

> For the first of these steps, the community will need to agree on a date, and a definition for what features are considered “new”. For example, one definition of “new” could be “features that cannot be polyfilled”.

I hope that includes WebRTC, since WebRTC can be used to figure out your local IP address, which (when combined with your public IP address) is essentially a unique identifier[0]. WebRTC is a technology that enables some great things (like Firefox Hello!), but it's a MASSIVE privacy hole[1], and one that I can't imagine justifying for non-secure endpoints.

EDIT: Added link to proof-of-concept attack

[0] https://www.browserleaks.com/webrtc

[1] https://github.com/diafygi/webrtc-ips/blob/master/index.html

Re: Deprecating Non-Secure HTTP

#4

Post by NeutronBoy » Thu, Apr 30, 2015, 11:33 PM UTC

rossng wrote: post #2

This is a pretty bold move, but I like the intent behind it. Hopefully Mozilla can pull it off without causing any problems for normal users. Presumably it will all be synced with their plans to launch a free CA[1] in the near future. [1] https://letsencrypt.org/

One thing I've never been able to figure out from Let's Encrypt's website - will you be able to get a certificate, without hosting your own instance? Or will it be limited to servers you can actually install their program on? Also, I assume they'll get the root CA included by all major vendors/browsers?

Re: Deprecating Non-Secure HTTP

#5

Post by tootie » Thu, Apr 30, 2015, 11:38 PM UTC

chimeracoder wrote: post #3

I'm very glad to see this. It's embarrassing to think that, just a few years ago, many major websites used HTTP for all but their login pages, and it took Firesheep to get them into gear. > For the first of these steps, the community will need to agree on a date, and a definition for what features are considered “new”. For example, one definition of “new” could be “features that cannot be polyfilled”. I hope that inc…

WebRTC uses DTLS as it's protocol which is encrypted.

Re: Deprecating Non-Secure HTTP

#6

Post by 15155 » Thu, Apr 30, 2015, 11:39 PM UTC

NeutronBoy wrote: post #4

rossng wrote: post #2

This is a pretty bold move, but I like the intent behind it. Hopefully Mozilla can pull it off without causing any problems for normal users. Presumably it will all be synced with their plans to launch a free CA[1] in the near future. [1] https://letsencrypt.org/

One thing I've never been able to figure out from Let's Encrypt's website - will you be able to get a certificate, without hosting your own instance? Or will it be limited to servers you can actually install their program on? Also, I assume they'll get the root CA included by all major vendors/browsers?

> will you be able to get a certificate, without hosting your own instance

> limited to servers you can actually install their program on

They did a bit of Q&A on HN or Reddit a while back, and it seems like you can use them in various capacities, but you'll certainly be able to get your certs signed without using their suite (and use them with the software of your choosing).

> Also, I assume they'll get the root CA included by all major vendors/browsers?

IIRC they're having another CA cross-sign.

Re: Deprecating Non-Secure HTTP

#7

Post by UnoriginalGuy » Thu, Apr 30, 2015, 11:40 PM UTC

I agree with trying to phase out HTTP, but I think their method is "annoying." What do features have to do with HTTP Vs. HTTPS? It just seems like an arbitrary punishment.

Wouldn't it just be significantly easier to simply change the URL art style to make clear that HTTP is "insecure." Like a red broken padlock on every HTTP page?

That has the following advantages:

- HTTP remains fully working for internal/development/localhost/appliance usage (no broken features).

- Users are reminded that HTTP is not secure.

- Webmasters are "embarrassed" into upgrading to HTTPS.

- Fully backwards compatible.

Seems like a perfect solution where everyone wins.

Re: Deprecating Non-Secure HTTP

#8

Post by thyrsus » Thu, Apr 30, 2015, 11:41 PM UTC

    "It should be noted that this plan still allows for usage of the “http” URI scheme in legacy content."

This is an important qualifier to the headline, and means that Firefox will remain workable with things that won't implement https for a decade.

Re: Deprecating Non-Secure HTTP

#9

Post by abhinai » Thu, Apr 30, 2015, 11:43 PM UTC

Hopefully they will also introduce a standard and free way to get SSL certificates. I do not like the idea of having to buy new certificates every year (and all the hassle that comes with installing the certificates) just to maintain a very basic website.

Re: Deprecating Non-Secure HTTP

#10

Post by talideon » Thu, Apr 30, 2015, 11:43 PM UTC

thyrsus wrote: post #8

"It should be noted that this plan still allows for usage of the “http” URI scheme in legacy content." This is an important qualifier to the headline, and means that Firefox will remain workable with things that won't implement https for a decade.

Hence 'deprecating': they're not getting rid of HTTP, it's just that HTTPS will be preferred, with HTTP sticking around for legacy purposes.