Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 83 introduces HTTPS-Only Mode

blog.mozilla.org

Post reply on HN
Print view View original

371–380 of 525 posts

Re: Firefox 83 introduces HTTPS-Only Mode

#371

Post by josephcsible »

zrm wrote: post #261
shawnz wrote: post #259

Earlier quoted context omitted.

That's not the point. Don't you need to hardcode some kind of identifier in order to use your malware's preferred DoH server instead of the user's preferred one (which could have content blocking applied)?

The issue is with Firefox overriding the system DNS with its own by default, when the system DNS may have content blocking applied and the Firefox default may not.

That's not an issue with overriding the system DNS. It's the point of overriding the system DNS. Content blocking by anyone but the user is a bad thing, and if you the user want it, then install uBlock Origin or something.

Re: Firefox 83 introduces HTTPS-Only Mode

#372

Post by danShumway »

Karunamon wrote: post #352
danShumway wrote: post #319

Earlier quoted context omitted.

There is nothing about DNS over HTTPS that requires you to use one centralized provider, and unencrypted DNS has always been easier for large corporations, ISPs, and the government to sniff. I think people are just totally off-base on this. The instances of government/corporation reactions to DOH that we have seen suggest that untrustworthy organizations and governments largely oppose the change. They would not oppos…

Firefox made DoH to Cloudflare the default, right? This is not responsive to my argument that it will impact most Firefox users. Most people won't change their defaults. Defaults matter. And that goes double when you need to dink with your own DNS server to override this crap.

Firefox made DoH default to Cloudflare, but that's because Firefox was the browser that pushed DoH the hardest when it came out, and at the time Cloudflare was (and arguably still is):

a) the best provider available

b) more importantly, the most private provider available

But there's nothing about the technology locking Mozilla into keeping Cloudflare the default in perpetuity, and in any case, the solution to your concern is to adjust the defaults, not to throw out DoH entirely.

There's nothing about DoH in specific that's causing the concerns you have. Mozilla could have set Cloudlfare DNS to be the default even for regular, unencrypted DNS traffic. There's nothing inherent in DNS technology that would force them to respect your OS settings. If your concerned about Cloudflare taking over, rejecting DoH isn't the solution to that problem.

It's not an underhanded centralization push, it just so happens that when DoH was still new, there was effectively one provider that was widely available, that could confidently handle a large upsurge in traffic, and that made extremely strong privacy guarantees compared to the rest of the industry. At the time Mozilla started pushing DoH, most ISPs in the US didn't even offer it as an option at all. As that changes, I expect that browser defaults will change as well.

Re: Firefox 83 introduces HTTPS-Only Mode

#373

Post by pbhjpbhj »

amenod wrote: post #156
acd10j wrote: post #97

Earlier quoted context omitted.

At least in my case network provided DNS are the worst, Full of spyware, and tracking.

How can DNS be "full of spyware"? Or are you saying that it is used for spying on you? But anyway, it is your decision to use them - you can use 1.1.1.1 (CloudFlare), 8.8.8.8 (Google - if you don't mind the tracking) or any other DNS provider.

Aren't all these public DNS getting unencrypted requests, so I assume ISPs snoop the domain lookups already, regardless of Google/Cloudflare/OpenDNS/Yandex doing so.

Re: Firefox 83 introduces HTTPS-Only Mode

#374

Post by josephcsible »

zrm wrote: post #298
shawnz wrote: post #279

Earlier quoted context omitted.

Yes, and I am saying the default should be to use a guaranteed source of truth and not something set by the network operator's policy. Same as how your trusted root CA certificates don't come from a network policy for example. I don't think we should be making a convention of inspecting users' private traffic, regardless of whether it is by default or by opt-in, under the guise of protecting them from malware. DNS ha…

The problem is "guaranteed source of truth" doesn't exist. When the network operator is you, or your family/company, you may trust the local DNS to respect your privacy more than you do Cloudflare. Not all names are intended to resolve the same everywhere -- sometimes the local DNS will give the RFC1918 address for a local server instead of the public one, or have a set of local names that are only accessible on the…

> you may trust the local DNS to respect your privacy more than you do Cloudflare

For most people, their local DNS is someone like Comcast or Verizon, way less trustworthy than CloudFlare. We shouldn't reduce the privacy of the majority of people just to increase it for a small minority of people by default.

Re: Firefox 83 introduces HTTPS-Only Mode

#375

Post by kibwen »

shadowgovt wrote: post #335
wildfire wrote: post #295

Earlier quoted context omitted.

The world would be a better place if voting was mandatory ( like it is in Australia ).

Agree to disagree. I've met enough Americans to believe that if we made voting mandatory, we'd just end up with Optimus Prime at the top of the ticket. You can make an act compulsory on the whole population but you can't legislate duty-of-care upon the whole population.

Voting should be mandatory but the first listed option for every office should be "I approve of no candidate and think none of them should win" (the disaffected vote), and the second listed option should be "I approve of every candidate and don't care who wins" (the apathetic vote). With our current system it's impossible to tease out how many voters are disaffected vs apathetic vs simply disenfranchised (in the above scheme, those who don't make it to the polls at all), which makes it impossible to confirm or deny that any candidate has the mandate of the people.

Re: Firefox 83 introduces HTTPS-Only Mode

#376

Post by aeturnum »

vbezhenar wrote: post #360
aeturnum wrote: post #359

Like others, I'm not exactly inspired by this feature. I'm an advocate for HTTPS-everywhere, but I think we're quickly moving past the point of usefulness for most people. On a personal level, as a developer, I actually find the ban on mixed connections on a web page much more frustrating. It's easy for me to get a cert for nginx for my side project. It's another thing entirely to figure out how to give my applicatio…

I don't understand your problem. Nginx should proxy all connections including websocket ones. Just don't expose your application server and use nginx as a reverse proxy.

I don't understand my problem either - if I did it wouldn't be a problem! I'm not here fishing for tech support, but this is a real thing I'm encountering and I don't know that expressing disbelief feels productive?

The point I'm trying to express is that giving a cert to your webserver is often only the first step in a relatively complicated process of securing all you assets. I wish browser makers would ask about blocking insecure connections instead of doing it by default.

If you're interested in the kind of thing I mean see below:

------------------------------------------------------------------------------------------

So, for example - I'm running a quart server on hypercorn for a side project. Just giving nginx the certs will not, for reasons I don't understand, allow a wss:// connection to successfully connect (returns a 400). The developer conversation around this[1] suggests giving the certs to the application server. I can confirm that this works, but again I don't understand why.

[1] https://gitlab.com/pgjones/quart/-/issues/319

Re: Firefox 83 introduces HTTPS-Only Mode

#377

Post by superkuh »

Jaruzel wrote: post #118

awww crap - I've got loads of low-traffic websites that don't need https[1] that I'm now going to have to spend time sorting out certificates for. To be honest, it's about time that cert enablement is built into all web server configs (on all OSs) as a native feature instead of having to manually roll the config using this-weeks-currently-preferred letsencrypt script. --- [1] Yes, yes, I know everyone on HN prefers e…

This is incredibly bad for the health of the web. In kneejerk response to the invasion of privacy from world governments we're handing absolute control of the web back to those very governments.

Everyone being forced to get permission from a centralized cert authority that is easily influenced, pressured, etc in order to host a visitable website is the end of the web as we know it. This is a slide into a total loss of autonomy.

I give it about 3 years before all commercial browsers stop allowing you to visit HTTP sites at all and Firefox only allows if you use their unstable beta build.

At that point you won't be able to host a visitable website without getting permission from someone else. And that's the end of the personal web.

Re: Firefox 83 introduces HTTPS-Only Mode

#378

Post by MaxBarraclough »

jevgeni wrote: post #361
MaxBarraclough wrote: post #235

Earlier quoted context omitted.

I'm afraid I don't see your point here, please elaborate.

Your point is "this should be applied to ALL sites", while your argument for it is "because it is relevant for SOME sites".

Not so. In the top link, points 2, 3, and 5, apply to all public websites.

Re: Firefox 83 introduces HTTPS-Only Mode

#379

Post by [deleted] »

pbhjpbhj wrote: post #363
shawnz wrote: post #213

Earlier quoted context omitted.

I would argue that the hurdle of bypassing DNS-based content blocking was already so vanishingly small that it doesn't make any sense to impede useful and practical privacy technologies on that basis. You could make the exact same kind of argument about widespread use of HTTPS for example. Do we want to allow encryption technology if it means the enemy can use it too? As a society we have agreed that encryption is a…

>I would argue that the hurdle of bypassing DNS-based content blocking was already so vanishingly small [...] // That doesn't hold up under scrutiny. My pihole blocks ~11% of domain lookups (blocking 1000 queries per day for our household), turning it off vastly increases the unwanted content. It might seem is logical a ready hurdle, but it's a hurdle that practically works. I don't follow the reasoning that says thi…

[deleted]

Re: Firefox 83 introduces HTTPS-Only Mode

#380

Post by dehrmann »

jchw wrote: post #18

I’m surprised at the negative knee-jerk reaction. I actually love this idea immediately. It encapsulates something I kind of already wanted when using HTTPS Everywhere. This doesn’t guarantee the transport is end-to-end secure; I’m sure plenty will strip the encryption at an LB and then possibly send it back over the internet. But, I think it’s a good addition nevertheless. Here’s to hoping for more DoH and encrypted…

Especially for average users, this is a lot better than the VPN snakeoil I keep seeing ads for.
Post reply on HN