...and I still still http-only sites from time to time.
Your post is brief, and has a grammar error that makes it harder to understand.
the second "still" is meant to be "sell" or "make".
Firefox 83 introduces HTTPS-Only Mode
21–30 of 525 posts
Re: Firefox 83 introduces HTTPS-Only Mode
#22What happens if i need to access localhost on http?
It will probably be a hardcoded exception, just like for enabling microphone/webcam access and other features today.
Re: Firefox 83 introduces HTTPS-Only Mode
#23I wonder how it will work against websites like http://neverssl.com (which helps me to log in to some wifi portals, HTTPS Everywhere shows the prompt for a temporary exception.)
Re: Firefox 83 introduces HTTPS-Only Mode
#24There had better be an about:config option to turn this stupidity off. Perhaps one of the downvoters can explain why the implied opinion "Nobody should be able to access your site without clearance from a third-party gatekeeper" belongs on a site called "Hacker News." And no, it won't be opt-in for long. Read the rest of the page: "Once HTTPS becomes even more widely supported by websites than it is today, we expect…
HTTPS is not about gatekeeping, you can use "let's encrypt" for free certificates for any domain.
HTTPS-only is about forcing all traffic to be encrypted by banning clear-text traffic. I've been using the "HTTPS everywhere" extension for years and it's great.
Re: Firefox 83 introduces HTTPS-Only Mode
#25There had better be an about:config option to turn this stupidity off. Perhaps one of the downvoters can explain why the implied opinion "Nobody should be able to access your site without clearance from a third-party gatekeeper" belongs on a site called "Hacker News." And no, it won't be opt-in for long. Read the rest of the page: "Once HTTPS becomes even more widely supported by websites than it is today, we expect…
> Perhaps one of the downvoters can explain why the implied opinion "Nobody should be able to access your site without clearance from a third-party gatekeeper" belongs on a site called "Hacker News."
I didn't vote down, but ironically this is news to real hackers who will have a harder time doing mitm downgrade attacks once this is widespread.
I believe that web browsers should alert users if a website uses a less secure protocol than "nearly all" of the rest of the websites they visit, for some value of "nearly all".
It's not preventing the user from visiting, just saying "heads up, the assumptions you make about the websites you visit don't hold for this one."
Re: Firefox 83 introduces HTTPS-Only Mode
#26What happens if i need to access localhost on http?
As other posters mention, you can disable this when you need to, but also browsers generally treat localhost and/or 127.0.0.1 as secure origins in themselves anyway, so I suspect that won't be necessary. See https://developer.mozilla.org/en-US/docs/Web/Security/Secure...:
> Locally-delivered resources such as those with http://127.0.0.1 URLs, http://localhost and http://*.localhost URLs (e.g. http://dev.whatever.localhost/), and file:// URLs are also considered to have been delivered securely.
Re: Firefox 83 introduces HTTPS-Only Mode
#27What happens if i need to access localhost on http?
It will probably be a hardcoded exception, just like for enabling microphone/webcam access and other features today.
To add to this: What interests me is how will they handle accessing the management interface of routers and various network equipment once HTTP gets deprecated.
Re: Firefox 83 introduces HTTPS-Only Mode
#28I just briefly played with it and there is an option to enable this mode globally and exclude specific sites (permanently or temporarily). Which is exactly what i needed.
Re: Firefox 83 introduces HTTPS-Only Mode
#29One change I'd like to see in browsers is when the user enters a domain without protocol in the url bar it interprets that as https instead of http.
Re: Firefox 83 introduces HTTPS-Only Mode
#30As a developer I likely won't use this feature much, considering most of our internal development sites are http only. For the general public it might be useful though, especially the auto-upgrade feature, protecting them from the lazy network operators that didn't add a proper auto-redirect.
According to another comment, you can still allow certain sites through http, so your Internet dev sites are still fine but the global sites will be blocked by default