Slashdot Mirror
With HTTPS Everywhere, Is Firefox Now the Most Secure Mobile Browser?
Peter Eckersley writes "Over at EFF, we just released a version of our HTTPS Everywhere extension for Firefox for Android. HTTPS Everywhere upgrades your insecure web requests to HTTPS on many thousands of sites, and this means that Firefox on Android with HTTPS Everywhere is now by far the most secure browser against dragnet surveillance attacks like those performed by the NSA, GCHQ, and other intelligence agencies. Android users should install the Firefox app and then add HTTPS Everywhere to it. iPhone and iPad users will unfortunately have to switch to Android to get this level of security because Apple has locked Mozilla Firefox out of their platforms."
Mixed-mode, beware!
I don't think HTTPS will stop the NSA
http://www.theguardian.com/world/2013/sep/05/nsa-gchq-encryption-codes-security
comment spam on an article about how something is so secure.
Too bad it doesn't have anything for spam bot control.
http://postimg.org/image/ryho8lbfj/
Doesn't mitigate any vulnerabilities already present in the browser. Doesn't add any encryption beyond what's already provided by the web servers.
Honestly.. I liked what the comment spammer said more. Less whine and more vomit..
People most likely don't type HTTP to begin with... I don't type http://facebook.com... just facebook.com. Google.com. slashdot.org. etc...
The S isn't just an extra S...
If I forget to type the S, I like having the crutch.
It's a bit like automatic collision avoidance braking systems that are starting to appear on cars these days: you might say it's a huge crutch for people who are too lazy to drive properly and maintain distances, but you know what? it's a good idea I'd like to have it nonetheless, in case my concentration lapses.
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
About 6 months ago the angry Android fanboi above these comments was rearranging his "apartment" in the "lower-level" of his parents home when he got his app rejection notice from Apple for his awesome new game "Flamin' Fowl".. the note contained a remark something to the effect that his app was of less quality than those Chinese knock off apps.
Since then he has with drawn even more.. he even stopped playing Magic.
I think MyCleanAndroid would have been a better app to flog with this article. Really.. what good does it do to https on your browser when the apps you have are full of holes and barely examined before being placed on the Google Play app store.
It was highly illogical for you to blockquote all of that bullshit, Spock. I am unsure which one of you is the dumber one.
And no I'm not RMS :(
RMS runs Hurd-Mobile OS on his phone.
Nonsense. If you're browsing the web and following a bunch of links, you would have to long press the link to copy it, long press to paste it in the url bar, edit the url to add the S (this is mobile, so moving the cursor directly between the "p" and the ":" is non-trivial), and hit enter... for every link you follow.
You can't just click the link and edit the url after the page loaded because you've already given away the url path, url query, cookies, referrer, etc to anyone snooping your connection. And what if a site doesn't support https and instead redirects you to its' http variant? For some people they'd rather it fail to load than load insecurely. There are many reasons to use such an extension.
Do you re-type links on a page instead of clicking them?
I will admit that I was skeptical that a piece of software could cure my cancer, bring back my wife and prevent me from beating my daughter but, based on dozens of posts on Slashdot, I'm willing to give it a try.
In some, but not all, cases it will also rewrite any http links within the site itself, which is a much more useful feature. People certainly do forget when typing URLs; but manually checking, copying, pasting, and editing links within a page would be a huge pain in the ass.
Now, as for why a site operator would have non-ssl links to parts of their site on parts of their site accessed over ssl, that's a question for when I'm feeling less rageful.
The above commenter is quite serious about their software fanboi-ism it verges on the realm of being a Linux anti-microsoft zealot.
'Secure' isn't really something where you can just boil it into a number between 1 and 100 and call it a day. If you are worried about attackers sniffing the wire, a plugin that enforces SSL use is a major advantage. If you are worried about being hit with a zero day by the guy on the other end of the wire, it's entirely irrelevant.
Replace the above comment with some drivel about Creationism and it will be just as useful.
I have one of those. I do actually like having it, for the reasons you say. Though in winter I do note it gets confused by snowbanks on the side of the road and occasionally cars in other lanes. Beep beep beeeeeeeep. Ahhhhhhh what?!
NSA has a copy of the private keys as well.
I'm not sure what's worse: the My Clean PC spam, or the hipsters that feel the need to reply to it every chance they can and tell us all about how they use Macs and how wonderful of people they are for doing so.
The NSA likely has keys from all the major SSL cert vendors, rendering this "spamvertisement" moot. HTTPS does not mean that you're secure from everybody. It means you've added a layer of security that will thwart MOST prying eyes, but those that really want to know what you're doing WILL know what you're doing.
What a silly thing to appear on slashdot.
Obviously it's the NSA's attempt at obscuring the news of this amazing new plugin for a browser on a phone...
> this means that Firefox on Android with HTTPS Everywhere is now by far the most secure browser
> against dragnet surveillance attacks like those performed by the NSA, GCHQ, and other intelligence agencies.
While I certainly think it is a good idea to encrypt traffic, this statement is highly misleading or naive: Since the CA
system is *flawd by design* and every one of those "authorities" in the long list of built-in CA inside
your browser can, by negligence or choice, supply any of these and other agencies with a valid certificate for
*any hostname in the world*, initiatives like these protect your privacy only from your local sysadmin/ISP, and also
do nothing against traffic analysis.
Should a US person/company trust that "China Internet Network Information Center" isn't going to create a cert for a
US bank or company to perform a MITM attach with? Should a Chinese company trust "Wells Fargo" not to?
Should the Greeks trust "TÜRKTRUST Bilgi letiim ve Biliim Güvenlii Hizmetleri A.. (c) Aralk 2007", or the
Turks "Hellenic Academic and Research Institutions Cert. Authority"? What on earth makes you think ALL of these
companies can resists pressures to misbehave? Yet all of them are built-in to your browser and "you" trust them.
Just go to any (Cloudflare, Akamai..)-accelerated site using https and check out the certificate used to see how that works:
They are issued certificates for the customer domains they accelerate, and hence have access to all the traffic.
In essence, they do exactly what a man-in-the-middle attack would do, except on a much grander scale (and with the collusion
of the actual domain holders). The agencies can carry out such attacks from within the ISP's, and your browser would still show "green".
The Cert validation in the browsers leads to a *dangerous false sense of security* at most. This is crypto, a weakest-link business
if ever there was one, folks. It's not ALL, or SOME that need to fail in order for PKI to fail, it's ANY of them.
Surely, we can do better than that: We should get rid of all centralised security illusions. Why aren't we signing contents using our PGP
keys that at least make multiple signers possible and habitual, and, and this is the essential difference, IMHO: That *you* have made a
conscious decision to trust or mistrust, to a certain degree, by reviewing a web of trust, as in informed consent as opposed to blind paternalism
of massivly built-in, pretrusted certificates by distant companies you really have no clue about.
WKR,
-f
Yes, secure connections are pretty useless if you are being tracked all the time anyway.
So what's with the uber pro-Firefox and Android spiel?
According to the web-site you can get the plug-in for Chrome as well. Albeit beta, but still.
And if that's the case, you can just install Chrome on your Apple device, it's in the itunes store, and install the plugin for it instead.
Man I gotta get me one of those!
wait don't go! have you tried MyCleanPC.. or maybe a https plugin for your mobile browser?
Use iptables to block outgoing requests to any port 80. Then decertify all the certs you don't trust (all of them.) Congratulations! Your web browsing experience is now secure!
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
This is a strong move by the EFF and Mozilla.
wtf is Apple going to do? promise they will offer the same protection?
I hate that Firefox can't get on the Apple App Store, and I like Apple products. But this...this is bullshit.
Will Apple somehow integrate a similar HTTPS into Safari?
Thank you Dave Raggett
seriously if they were trying to troll in order to stifle discussion about this topic, that mycleanPC thing kinda worked...
reminds me of APK...
maybe this is a level 2 deployment of the APK chatbot AI
Thank you Dave Raggett
And no I'm not RMS :(
no need to stipulate that.
For this to work, the site must support https, and a lot of sites don't...
But you might have a reason to reply to a post from a creationist. In this case, parent is just wasting everyone's viewport space.
If you post as an AC, don't expect me to spend a mod point on you.
For the first time I see the death of /. coming around the bend.
You must be new here.
dude you are owning this thread. is the plugin compatible with my HOSTS file?
In case you don't get it: It's obviously intended to mimic a fake anti-malware product that spams people with ads for itself.
Yes, there is a product by that name, which is called out as a "borderline scam" - though mainly with claims that it does little (removing key-only registry entries), may cause trouble, and buying it can result in a periodic charge to your credit card that is difficult to stop.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
... it gets boring when repeated too often,
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
With HTTPS Everywhere, Is Firefox Now the Most Secure Mobile Browser?
You obviously think it is, so why did you phrase that as a question?
systemd is Roko's Basilisk.
Supporting https everywhere is *not* a sufficient single reason to be called "the most secure browser".
Monocausal interpretations of security are the worst enemy of security.
So basically all this does is to force HTTPS requests instead of HTTP? (took me a while to find out - gotta love the fact that the "clever technology" link on their site, instead of going to a description of the actual technology, goes to... xkcd?! :) )
I see a few problems with this approach:
1)Not all content is provided over both HTTP and HTTPS. For multiple reasons, one being performance. Which leads us to the second problem...
2)A HTTPS session incurs a significant overhead for encryption. Which may be no problem for someone like Google. But for someone hosting his/her own (moderately successful) website on a small server, it might just overload said server.
3)Quite possibly the biggest problem with HTTPS is the fact that users have been trained over many years to just click "accept/install certificate" on self-signed certs. Not knowing that if you do this you are no longer secure.
And the more we keep forcing HTTPS, the more webmasters will use self-signed certs. Not many people want to go through the hassle of obtaining (and maintaining!) a valid SSL certificate for every single website they run, even if that cert is free. Which will only exacerbate the problem...
Not the first time either... IDK why the admins can't impose a rule about duplicate posts in the comments.
How many cases are there that one user would need to make a dozen identical posts of over 1000+ words?
You're confusing User with Customer. We're the users, advertisers are the customers.
"Can remove spam" and "will remove spam" are not the same thing. They absolutely, trivially could prevent this kind of spam - but why would they? Nobody at Dice cares! In all the years I've come here I've never seen the admins do anything remotely resembling administration of their site.
Another comment on a thread, no matter how trivial or spammy, enforces the illusion of a site that is still alive. This illusion is used to make the search indexers think that something of relevance is going on at the site, and rate it higher, which in turn exposes yet more of Dice's advertising. The key to proper SEO is novel content, the trick is that the content doesn't have to be at all relevant or even coherent, it just has to be new and Google will swallow it like a junior at the prom with the star jock.
Whenever some moron codes up a new incarnation of retardo-bot and launches it in a flurry of masturbation, a whole host of /. users will flock around and comment on the spam. It's a viscous cycle and Dice has no incentive to stop it.
Short story even shorter: Dice runs the site. Dice profits from not removing spam posts.
... whatever
This is stupid, there's no benefit to using https on many sites. We can understand a security need by thinking about confidentiality, integrity, and availability. If I connect with https to a site which doesnt have my personal data (e.g. news sites) there is no benefit to confidentiality - the site is availabile to anyone, the info isnt confidential to me. Integrity - without 2 way authentication (which https typically doesnt do) there is only a marginal increase in difficult to compromise the integrity of a http request or response. Why would anyone do that with something like news though. Availability https doesnt change anything, probably makes it worse as the site has to negotiate TLS sessions Accessing sites with personal data, banks, email, faceboook - https is essential. Accessing sites without personal info, such as news, https accomplishes strictly nothing, it's is a waste of cpu cycles and the energy that powers them
is this publicity stunt a sign of some trouble at firefox? otherwise they should be smarter than making stupid claims like this, right?
It's a viscous cycle
Maybe we should sticky this.
I knew I needed to stop reading Slashdot and finish my PhD when I started to miss articles by Bennett Haselton.
We really should! In my defense I work with fluid mechanics so viscosity comes up a lot.
... whatever
where is the HTTPS terminated and who holds the keys?
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
There is a duplicate post filter. It's just extremely easy to bypass.
Just want to say thank you
if you see me, smile and say hello.
You need to add them to the Java Control Panel applet exception list. Works for me.
This doesn't work with Slashdot. At least if you put in a https, it redirects, so they have it set up; they just don't use it. You would think that a technology site would be up on current technology.
.
It is not.
On the other hand, I would feel extremely uncomfortable if they /did/ moderate the comments. Because that sort of activity can quickly snowball from their just deleting spammer accounts/comments to zapping comments that they disagree with or feel is not in the company's interests. Especially since the users do such a good job of cleaning up the trash themselves (honestly, except on the occassions when I read at comment level 0, I never even SEE these MyCleanPC or other spam/troll comments anymore).
I wish Dice did better editing the SUBMISSIONS (even if all they did was correct any typos or prevent obvious dupes) but I am far happier if they keep their hands off the comments themselves.
It's actually wrapped back around to advertising. See, they're just trying to camouflage it as "humorous" to get one or two people to think it's funny, haha, cute joke while getting their name out there. The problem is that it's still just advertising. It just requires an extra layer of cynicism to see it for what it is.
Doesn't' beta.slashdot.org count as something resembling administration?
This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
as sweet
Or the people who feel the need to start a new comment thread talking about people talking about spamming...
Crap. Now I'm talking about people talking about people talking about spamming.
Unity? Screw that: XFCE. Slashdot Beta? Screw that: SoylentNews. Australis? Screw that: Pale Moon. UX developers DIAF
Nonsense. If you're browsing the web and following a bunch of links, you would have to long press the link to copy it, long press to paste it in the url bar, edit the url to add the S (this is mobile, so moving the cursor directly between the "p" and the ":" is non-trivial), and hit enter... for every link you follow.
And don't forget the waiting for it to fail and changing it back to HTTP:// when you get a server that doesn't have https.
I guess for some, very broad, interpretations of the word "administration". Kind of like how a steaming pile of dog shit resembles chocolate cake.
... whatever
Betteridges Law of Headlines finally proven wrong?
I agree with this. The moderation here is designed to make deleting or blocking posts unnecessary, and I like that.
I also like that you can't edit posts since lots of people like to troll and change their post after it get's responses to make responders look like idiots.
War doesn't show who is right - just who is left.
On the other hand, I would feel extremely uncomfortable if they /did/ moderate the comments. Because that sort of activity can quickly snowball from their just deleting spammer accounts/comments to zapping comments that they disagree with or feel is not in the company's interests. Especially since the users do such a good job of cleaning up the trash themselves (honestly, except on the occassions when I read at comment level 0, I never even SEE these MyCleanPC or other spam/troll comments anymore).
Yes, there are plenty of other places on the 'net where anal mods have free roam, we don't need another. I don't agree that the users here do a good job of cleaning up. They do a very good job of promoting circle jerking by instantly promoting mundane comments to +5 Funny/Insightful/Interesting for agreeing with them. I always browse at -1 for that very reason, once in a while a -1 comment will actually have something novel to say.
I wish Dice did better editing the SUBMISSIONS
I agree! But that is a problem to which my original explanation also applies. They've got no reason to clean it up. Posting craptastic submissions just spawns threads much like this one, where people discuss how god awful /. has become and how much better "the olden days" were. /. is unique in the way it handles news aggregation and user composed content. Dice has just elected to take a dump all over the concept to maximize profits. They could do something about the shit that keeps dripping on us, but why should they when we keep coming?
I find that blocking submissions from Roblimo actually takes care of most of the idiocy that gets posted, at least the obvious for-profit stories goes away. Now they just need a spell checker, if they get that right we could go for gold and demand they also fact check.
... whatever
For the first time I see the death of /. coming around the bend.
You must be new here.
Amen to that
Talking about people talking about people talking about people spamming is so 6 comments ago.
I guess Dice is throwing stuff at the site and is waiting to see what sticks?
It looks like I can filter the Beta site comments by ranking, but there is then no way to read a parent comment if it doesn't make the cut. This gives me the choice of, read all this CleanPC shit, or not be able to read the low ranked parent of any highly ranked post.
It also appears that the post anonymous feature is gone. Now I'm going to have to completely log out to do that. I'm not impressed with this.
Does Netcraft confirm it?
If you disagree with me on social issues, then it's pretty clear that you are a narrow-minded bigot.
you can't install it yourself on the vast majority of shared hosts - many also don't have SNI enabled and will also require that you use a dedicated IP for the cert which is extra cost there.
SNI support is part of why I switched pineight.com from Go Daddy shared hosting to WebFaction shared hosting. But I think shared hosts don't offer SNI hosting because of the perceived support cost of complaints from users of Internet Explorer for Windows XP. It and Android Browser for Android 2.x are the last two remaining major browsers that don't support SNI. But in two months, Microsoft will stop releasing security updates for Windows XP. At that point, migrating to SNI will make sense because server operators can presume that IE/XP is insecure, especially once computer vandals start deploying client-side MITM through a forever-day exploit in Windows XP. The login form summarizes the Firesheep, SNI, and IE/XP issues and links to a TLS version of the form for users with compatible browsers.
When I type www.google.com and my browser sends me to HTTP://www.google.com, why would it be be a crutch to have it send me to HTTPS:// instead?
Yes, directing people to https when they click http on a page is a crutch, but for the designers, who obviously don't care, not for the user.
Learn to love Alaska
Unfortunately i'm not sure that [end of support] will stop people using [Windows XP].
They will likely stop once enough popular web sites start informing them about the end of support and its ramifications. The message for old IE would look like this, including a subtle dig at the Copyright Term Extension Act:
And the message for old Android Browser would look like this:
That's GNU/Hurt-Mobile OS. Have you heard a single word RMS has said?!
Chuuch. Preach. Tabernacle.