Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 83 introduces HTTPS-Only Mode

blog.mozilla.org

Post reply on HN
Print view View original

521–525 of 525 posts

Re: Firefox 83 introduces HTTPS-Only Mode

#521

Post by ric2b »

superkuh wrote: post #478
ric2b wrote: post #390

Earlier quoted context omitted.

I think you misunderstand how HTTPS works, there's no central root CS, nothing stops you from adding other trusted root certificate authorities. In fact, your browser trusts a few dozens of different ones, and companies routinely manage their own.

No, I'm just assuming that you're going to follow through on that thought and realize statistically no one does that for self signed certs except corporations which aren't human persons anyway.

The point isn't that you can run it yourself, it's that there isn't a central one and there are dozens or hundreds of different options already, based in different countries.

Re: Firefox 83 introduces HTTPS-Only Mode

#522

Post by anaganisk »

iso1631 wrote: post #392
tyingq wrote: post #342

I do worry about the sort of monoculture with Let's Encrypt. A second and third provider that do the same thing would reduce the blast radius for potential outages. Grateful for LE, but there's a lot riding on it. Similar for Cloudflare.

Yes, LE goes boom for some reason, and there's at most 30 days to get a working replacement online before server certificates start failing. I'll try to keep my tin hat stored.

Or just a day, if people wait till the deadline

Re: Firefox 83 introduces HTTPS-Only Mode

#523

Post by cat199 »

taftster wrote: post #271
cat199 wrote: post #214

Earlier quoted context omitted.

this breaks caching of simple objects that do not require content security

Even "simple objects" can be MITM'd. I know I'm on the extreme theoretical edge, and so maybe your perspective is pragmatic enough to pass. But even small images, javascripts, etc. should be protected by HTTPS, not just "sensitive" pages. As an end user, I don't want the possibility of anything being tampered with along the route. As a content owner / webmaster, I want the same. So publisher and consumer are both ali…

speaking specifically of local package caches for things like onsite networks which are themselves signed OOB

Re: Firefox 83 introduces HTTPS-Only Mode

#524

Post by cat199 »

SulfurHexaFluri wrote: post #452
cat199 wrote: post #214

Earlier quoted context omitted.

this breaks caching of simple objects that do not require content security

The browser can still see everything and still cache whatever it wants. Safari and likely others are turning off cross site caching anyway.

HTTP != browser always

Re: Firefox 83 introduces HTTPS-Only Mode

#525

Post by palominoz »

shadowgovt wrote: post #343
palominoz wrote: post #144

I hope they aren't going to force users in https-only in the future. Software shouldn't cut off legacy content (old websites that aren't going to be upgraded with https) something just because in theory it is more secure. If someone is surfing the web as an adult he is responsible of himself. Other than this there are historical components (web firewalls) that aren't going to work anymore .. so security is a matter w…

Because browsers run code, they exist in that tricky space where some design decisions have to be made for the good of the commons. If you visit an HTTP site and get MITM'd, it's not just that the attacker can put you at risk by spoofing a credential input box; it's that the attacker can put third parties at risk by having your browser XMLHttpRequest as fast as it can at at someone else's site to try and DDOS them. A…

I think your comment goes specific, but i was talking generally. I don't really understand if you are arguing against my opinion.. I don't know what to respond.. bye
Post reply on HN