Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why HTTPS Everywhere isn't on addons.mozilla.org

lists.eff.org

Post reply on HN
Print view View original

31–40 of 61 posts

Re: Why HTTPS Everywhere isn't on addons.mozilla.org

#31

Post by Confusion »

Steko wrote: post #18

"main reason I haven't put it in AMO yet is because AMO offers less security to users than EFF self-hosting it" Another pointless crusade. Aren't there many ways you could make it safer still? Wouldn't some of those be really dumb because they would prevent many people from accessing the add on? How many people are you making more secure? Close to no one because 98% of Firefox https everywhere users have some other a…

  Aren't there many ways you could make it safer still?
None that are necessary and relevant for the plugin to be offered via AMO.

Should we trial this medicine on humans? No, that's another pointless crusade. Aren't there many other ways you could make it safer still? Your argument applies to any requirement and thus to none.

  Weigh that against the many thousands more that might be 
  experiencing the benefits
"Many thousands more: of whom you don't know whether they are experiencing any benefits, because you don't know whether they are actually using the code you published, instead of a compromised variation.

Re: Why HTTPS Everywhere isn't on addons.mozilla.org

#32

Post by riquito »

geofft wrote: post #29
johannh wrote: post #12

> AMO doesn't do any code signing for extensions, so they're only protected by HTTPS. As we saw with Heartbleed, SSL private keys can be compromised. I find it quite ironic that HTTPS Everywhere is arguing HTTPS is not safe enough to offer them a reasonable guarantee of integrity.

HTTPS is a lower bound of reasonable security, not an upper one. The argument for HTTPS _everywhere_ is that it's the smallest possible thing you can do to make yourself slightly secure. Would you find it ironic that someone selling combination locks for gym lockers wants a better lock on their storefront?

> Would you find it ironic that someone selling combination locks for gym lockers wants a better lock on their storefront?

More like he wants to add additional security measures because the lock isn't secure enough. I wouldn't buy a lock then.

Re: Why HTTPS Everywhere isn't on addons.mozilla.org

#33

Post by Confusion »

zobzu wrote: post #21

Im all for signing stuff but: - amo wasnt affected by heartbleed - signatures arent foolproof either - HTTPS everywhere.. is supposed to advocate for TLS being safe ? So the criticism seems quite misguided in this case.

  - amo wasnt affected by heartbleed
If you only address issues that have already happened, you will never provide adequate protection. The point is to ensure sane behavior when AMO is affected by some exploit.

  - signatures arent foolproof either
Yeah, and actually, why bother with HTTPS at all: it's not foolproof, is it?

  - HTTPS everywhere.. is supposed to advocate for TLS being 
    safe ?
No, it advocates for TLS being safe if used with HTTPS everywhere. So before you have HTTPS everywhere enabled, you need an additional measure.

Re: Why HTTPS Everywhere isn't on addons.mozilla.org

#35

Post by passfree »

HTTPS is a good idea but it really doesn't work for me. I am one of those paranoid people who want full end-to-end SSL without exceptions. HTTPS Everywhere doesn't fill the bill.

This is why the company I work for created PanicMode (https://chrome.google.com/webstore/detail/panic-mode/lamdafc...).

PanicMode is ridiculously simple extension. Once activated, it will swap HTTP for HTTPS without leaking even a single packet. Not even pre-flight requests are spared.

PanicMode is not good for general purpose browsing mainly because 99% of the site break badly, i.e. they do not support SSL at all. That is very telling and sad reality. The way I use it is with profiles. I have a bunch of chrome profiles that I use for different purpose. One of my profiles is just for social browsing - facebook etc. I have another one for company stuff. Those profile have panic mode installed and activated. Because I care about security in those profiles I don't mind if I click on a facebook link and it doesn't open up because at least I know that I am protected against side-channel attacks.

It is a very simple mechanism but works well when used effectively.

Re: Why HTTPS Everywhere isn't on addons.mozilla.org

#36

Post by JetSpiegel »

passfree wrote: post #35

HTTPS is a good idea but it really doesn't work for me. I am one of those paranoid people who want full end-to-end SSL without exceptions. HTTPS Everywhere doesn't fill the bill. This is why the company I work for created PanicMode ( https://chrome.google.com/webstore/detail/panic-mode/lamdafc... ). PanicMode is ridiculously simple extension. Once activated, it will swap HTTP for HTTPS without leaking even a single p…

Looks interesting, but what's the purpose of the button?

Also, any interest in porting it to Firefox?

Re: Why HTTPS Everywhere isn't on addons.mozilla.org

#38

Post by johannh »

geofft wrote: post #29
johannh wrote: post #12

> AMO doesn't do any code signing for extensions, so they're only protected by HTTPS. As we saw with Heartbleed, SSL private keys can be compromised. I find it quite ironic that HTTPS Everywhere is arguing HTTPS is not safe enough to offer them a reasonable guarantee of integrity.

HTTPS is a lower bound of reasonable security, not an upper one. The argument for HTTPS _everywhere_ is that it's the smallest possible thing you can do to make yourself slightly secure. Would you find it ironic that someone selling combination locks for gym lockers wants a better lock on their storefront?

I find it ironic if banks and post offices are using combination locks as advertised security measures but the people selling those install steel doors on their storefront.

Re: Why HTTPS Everywhere isn't on addons.mozilla.org

#39

Post by cbr »

Steko wrote: post #25
n09n wrote: post #23

Earlier quoted context omitted.

It's almost as if their priorities aren't the same as yours.

My priorities are completly irrelevant here, I've been a happy user of https everywhere since idk since I heard of it (years? idk). My criticism is that their own stated priority is being crippled by a self-imposed and arbitrary rule.

It looks to me like they're trying to use not being in AMO as leverage to get Mozilla to implement additional security features. If they said "we'd like these features, but we're ok being in AMO in the mean time" Mozilla would probably mostly ignore them, and these are generally useful features that should help others if developed.

Re: Why HTTPS Everywhere isn't on addons.mozilla.org

#40

Post by blcknight »

fastball wrote: post #5
blcknight wrote: post #3

Old... but interesting, I guess. From the bug report: > We don't require update.rdf files to be signed when they're served over HTTPS, since HTTPS provides the same level of verification as an updateKey, and we don't see significant benefit to the additional level of verification. I'm kind of confused by that comment - Mozilla are saying that signing the software itself is somehow the same as serving it over HTTPS? T…

I think the idea is that you don't need the extra security of signing, because if the file was served over HTTPS then you can be secure in the knowledge that it has not been modified. The reason you sign packages is to ensure that the file you want and the file you get are actually the same. If you have a secure connection to the trusted host of said file, you don't need to worry about that.

All someone needs to do is hack the AMO servers and change out the XPI -- and no one would no the difference, because the packages aren't signed.

Not to also mention, MITM attacks on the actual SSL connection.

Serving over HTTPS isn't a valid package signing strategy.

Post reply on HN