Firefox 90 supports Fetch Metadata Request Headers
blog.mozilla.org
Firefox 90 supports Fetch Metadata Request Headers
1–10 of 109 posts
Re: Firefox 90 supports Fetch Metadata Request Headers
#2How is this different from the origin header? Does the origin header not tell the webbserver if the requested originated from the same website? Is the origin header flawed in some way?
Re: Firefox 90 supports Fetch Metadata Request Headers
#3How is this different from the origin header? Does the origin header not tell the webbserver if the requested originated from the same website? Is the origin header flawed in some way?
It seems silly to me too but re reading https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Or...
“ There are some exceptions to the above rules; for example if a cross-origin GET or HEAD request is made in no-cors mode the Origin header will not be added.”
Re: Firefox 90 supports Fetch Metadata Request Headers
#4How is this different from the origin header? Does the origin header not tell the webbserver if the requested originated from the same website? Is the origin header flawed in some way?
Reading the documentation on MDN[1] it looks like it sends more data than just the Origin of the request. Metadata headers include if the user initiated the request (e.g. navigation or click events?) and how the data is meant to be used (e.g. as audio data for or a top-level document).
This spec seems really powerful, provided all browser support it :)
[1]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers#fe...
Re: Firefox 90 supports Fetch Metadata Request Headers
#5Since Encrypted SNI was disabled in Firefox 85, all the hostnames are transferred in plaintext, even using HTTPS. It was also disabled from Firefox ESR 78 at one point around ESR 78.9
This Not only makes DNS over HTTPS absolutely useless, but it is also giving browsing information by duplicate, to the ISP, to the intermediaries and to the DNS providers.
From the article, "If you aren’t a Firefox user yet, you can download the latest version here to start benefiting from all the ways that Firefox works to protect you when browsing the internet"
I did not expected Firefox 90 forget about this matter and talk about protection, when they got rid of Encrypted SNI in FF 85 without warning, and without having any other alternative actively working.
We went from an incomplete solution (ESNI) to having nothing at all. Meanwhile ECH (encrypted client hello) keep sounding like vaporware by the moment. Please...
Re: Firefox 90 supports Fetch Metadata Request Headers
#6Does that mean that the quest of finding a working direct link to the image/video will soon become impossible?
Re: Firefox 90 supports Fetch Metadata Request Headers
#7Since Encrypted SNI was disabled in Firefox 85, all the hostnames are transferred in plaintext, even using HTTPS. It was also disabled from Firefox ESR 78 at one point around ESR 78.9 This Not only makes DNS over HTTPS absolutely useless, but it is also giving browsing information by duplicate, to the ISP, to the intermediaries and to the DNS providers. From the article, "If you aren’t a Firefox user yet, you can dow…
If ESNI is fundamentally flawed, how is it better than nothing at all? At that point isn't it just cargo cult "protection"?
Re: Firefox 90 supports Fetch Metadata Request Headers
#8How is this different from the origin header? Does the origin header not tell the webbserver if the requested originated from the same website? Is the origin header flawed in some way?
Reading the documentation on MDN[1] it looks like it sends more data than just the Origin of the request. Metadata headers include if the user initiated the request (e.g. navigation or click events?) and how the data is meant to be used (e.g. as audio data for or a top-level document). This spec seems really powerful, provided all browser support it :) [1]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers#fe…
Firefox, Chrome, Edge and Opera support it (including mobile).
Internet Explorer is dead (ok, is a Zombie. But was supper-seeded by Edge for most users).
Safari is sadly not yet supported.
The nice thing is that you can employ security enhancements based on this technique even if it's not supported by all your clients.
I.e. you can automatically reject requests if the headers are given and have a bad value, which would add additional protection against certain attacks for all users except the ones stuck on IE or Safari.
Re: Firefox 90 supports Fetch Metadata Request Headers
#9Does that mean that the quest of finding a working direct link to the image/video will soon become impossible?
If site producers want to it's already pretty much impossible today. At least without some "tricks", and nothing prevents your video-downloader from just adding a header which pretend it's origin is a website. (Or more funny you inject the downloading JS code into the website in question extending it with a download functionality ;=) ).
Re: Firefox 90 supports Fetch Metadata Request Headers
#10Since Encrypted SNI was disabled in Firefox 85, all the hostnames are transferred in plaintext, even using HTTPS. It was also disabled from Firefox ESR 78 at one point around ESR 78.9 This Not only makes DNS over HTTPS absolutely useless, but it is also giving browsing information by duplicate, to the ISP, to the intermediaries and to the DNS providers. From the article, "If you aren’t a Firefox user yet, you can dow…
ESNI wasn't just incomplete/providing partial protection it had interop/scaling problems that would have made it a bad thing to continue to promulgate. It was probably a smart move to cut the cord for the redo to ECH while ESNI had single digit percentage server support considering most of the waiting for ECH is for server support as well.
In the meantime DoH is still very useful for a typical end user. It is orders of magnitude more work to filter all web traffic for the SNIs than it is to literally get directly notified by the client when a new site is looked up. Not to mention it's nice to have the scale proven out independently instead of trying to throw the kitchen sink at privacy when everything is fully baked and hope nothing falls apart that day.