Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 83 introduces HTTPS-Only Mode

blog.mozilla.org

Post reply on HN
Print view View original

151–160 of 525 posts

Re: Firefox 83 introduces HTTPS-Only Mode

#151

Post by ignoramous »

iso1631 wrote: post #87
jchw wrote: post #18

I’m surprised at the negative knee-jerk reaction. I actually love this idea immediately. It encapsulates something I kind of already wanted when using HTTPS Everywhere. This doesn’t guarantee the transport is end-to-end secure; I’m sure plenty will strip the encryption at an LB and then possibly send it back over the internet. But, I think it’s a good addition nevertheless. Here’s to hoping for more DoH and encrypted…

I want my OS to do DNS - including DOH, not my browser. I want a single source for my DNS I want my network to tell me a DNS server to use. As I own my computer I can override that, but much of the time I want to use the network provided DNS server.

> I want my OS to do DNS - including DOH, not my browser.

The cat is out the bag, so to speak. I foresee a lot of adware, spyware, and malware leveraging DoH now to evade just about every DNS-based monitoring/blocking/provisioning solutions.

Anyway, the right layer to monitor for Internet traffic has always been the IP layer (VPNs notwithstanding).

Re: Firefox 83 introduces HTTPS-Only Mode

#152

Post by cmeacham98 »

zapt02 wrote: post #58
jabl wrote: post #42

Earlier quoted context omitted.

IIRC HTTPS Everywhere works by having a whitelist of domains that are also accessible over https, and switches to https for those. So if a site isn't in the whitelist, it won't modify the request in any way.

HTTPS Everywhere will attempt to connect to a site using SSL, and if that times out will pop out an error message and allow you to load the site over HTTP temporarily. At least that's how it works on Firefox + latest version of the extension.

Only if you have the "encrypt all elgible sites" option enabled, which is disabled by default.

Re: Firefox 83 introduces HTTPS-Only Mode

#153

Post by abdullahkhalids »

dusted wrote: post #60
m_eiman wrote: post #53

It's obvious I need to spend more time researching Gemini and similar things. The "web" is going to be a true monoculture very, very soon.

I agree. HTTPS is great, at definitely needed for a lot of things. But I don't need my cat pictures encrypted, I don't need lots of things encrypted, and frankly, I don't want it to be encrypted when it's not required, it's a waste of resources, both processing and network. Then there is the case of all the old computers that either lack the processing power or support for modern algorithms.

You don't need your cat pictures encrypted per se, but you do want to ensure that your Webportal cannot MITM your communications with catpictures.com and inject malicious javascript into the webpage.

Re: Firefox 83 introduces HTTPS-Only Mode

#154

Post by afiori »

globular-toast wrote: post #143
afiori wrote: post #138

Earlier quoted context omitted.

> Am I supposed to trust them more than some man-in-the-middle just because they own a domain name? The green padlock will not turn any unreliable fake news site of your choise in a trustworthy outlet but it does make some guarantees about it being the same site as yesterday (barring security leaks or missed DNS renewal) AFAIU the elefant in the room is that if your DNS resolver is malicious and points all domains to…

> but it does make some guarantees about it being the same site as yesterday No it doesn't. Are you thinking of TOFU via public key pinning?

I was oversimplifying my limited understanding. What I belive should be true is that you are connecting to a server that:

1. managed to obtain a valid certificate from some recognized autority

2. managed to steal a valid certificate for the domain in question from another server

3. managed to convince enough DNS resolvers to point to their IP for a given domain (so to get your traffic and/or pass LE challenges)

and/or other conditions. From an operational perspective it says very little, especially considering the third case where any public wifi network has in most cases total initial control over your DNS traffic.

Re: Firefox 83 introduces HTTPS-Only Mode

#155

Post by EastSmith »

ignoramous wrote: post #151
iso1631 wrote: post #87

Earlier quoted context omitted.

I want my OS to do DNS - including DOH, not my browser. I want a single source for my DNS I want my network to tell me a DNS server to use. As I own my computer I can override that, but much of the time I want to use the network provided DNS server.

> I want my OS to do DNS - including DOH, not my browser. The cat is out the bag, so to speak. I foresee a lot of adware, spyware, and malware leveraging DoH now to evade just about every DNS-based monitoring/blocking/provisioning solutions. Anyway, the right layer to monitor for Internet traffic has always been the IP layer (VPNs notwithstanding).

Can you elaborate? An adware app will be installed in the OS, and will proxy all DNS requests?

Re: Firefox 83 introduces HTTPS-Only Mode

#156

Post by amenod »

acd10j wrote: post #97
iso1631 wrote: post #87

Earlier quoted context omitted.

I want my OS to do DNS - including DOH, not my browser. I want a single source for my DNS I want my network to tell me a DNS server to use. As I own my computer I can override that, but much of the time I want to use the network provided DNS server.

At least in my case network provided DNS are the worst, Full of spyware, and tracking.

How can DNS be "full of spyware"? Or are you saying that it is used for spying on you?

But anyway, it is your decision to use them - you can use 1.1.1.1 (CloudFlare), 8.8.8.8 (Google - if you don't mind the tracking) or any other DNS provider.

Re: Firefox 83 introduces HTTPS-Only Mode

#157

Post by iso1631 »

tmsbrg wrote: post #122
implying wrote: post #77

This is a great step, but I wish browsers would allow you to set domains that are considered to be secure origins in all cases. I have a decent intranet with transport security guaranteed by VPN, but because it isn't "HTTPS" I can't access tons of browser features.

Have a look at Let's Encrypt DNS challenge. I created a DNS wildcard certificate for a subdomain I own and use it for all my internal domains. A great way to get HTTPS on non-public networks. HTTP over VPN is still weaker than HTTPS over VPN. For example HTTPS also handles authentication which HTTP doesn't. If you're outside of your VPN, a MitM could redirect you to http://my-internal-domain.example and resolve its D…

Deploying to a mix of internal devices, many of which lack the ability to easily allow automatic certificate renewal, is not trivial.

Re: Firefox 83 introduces HTTPS-Only Mode

#159

Post by BostonEnginerd »

EastSmith wrote: post #155
ignoramous wrote: post #151

Earlier quoted context omitted.

> I want my OS to do DNS - including DOH, not my browser. The cat is out the bag, so to speak. I foresee a lot of adware, spyware, and malware leveraging DoH now to evade just about every DNS-based monitoring/blocking/provisioning solutions. Anyway, the right layer to monitor for Internet traffic has always been the IP layer (VPNs notwithstanding).

Can you elaborate? An adware app will be installed in the OS, and will proxy all DNS requests?

Apps will make DOH requests from within their apps to avoid host-based DNS blocking.

Re: Firefox 83 introduces HTTPS-Only Mode

#160

Post by iso1631 »

ignoramous wrote: post #151
iso1631 wrote: post #87

Earlier quoted context omitted.

I want my OS to do DNS - including DOH, not my browser. I want a single source for my DNS I want my network to tell me a DNS server to use. As I own my computer I can override that, but much of the time I want to use the network provided DNS server.

> I want my OS to do DNS - including DOH, not my browser. The cat is out the bag, so to speak. I foresee a lot of adware, spyware, and malware leveraging DoH now to evade just about every DNS-based monitoring/blocking/provisioning solutions. Anyway, the right layer to monitor for Internet traffic has always been the IP layer (VPNs notwithstanding).

I've always assumed any device or program I don't control will bypass anything I tell it to use and tunnel all it's evil traffic.

It does feel the world is moving away from a multi-level network to run everything over TLS/TCP (and probably eventually mainly TLS/UDP), taking away the power from me as a network and device owner, and giving it to the developers

Post reply on HN