Slashdot Mirror
Firefox Prepares To Mark All HTTP Sites 'Not Secure' After HTTPS Adoption Rises (bleepingcomputer.com)
An anonymous reader quotes a report from Bleeping Computer: The increased adoption of HTTPS among website operators will soon lead to browsers marking HTTP pages as "Not Secure" by default, and Mozilla is taking the first steps. The current Firefox Nightly Edition (version 59) includes a secret configuration option that when activated will show a visible visual indicator that the current page is not secure. In its current form, this visual indicator is a red line striking through a classic lock that's normally used to signal the presence of encrypted HTTPS pages. According to Let's Encrypt, 67% of web pages loaded by Firefox in November 2017 used HTTPS, compared to only 45% at the end of last year.
Let's say I'm downloading a file that's several GB, like a disk image. When I download it, I'll verify the signature. If it's valid, the file is usable. Encrypting the entire download is a waste of resources for both the server and client. Not everything needs to be encrypted, so this is a little silly. Plus, hosting providers often charge extra fees for https, at least based on my experience.
This is completely retarded. Not every site needs https.
HTTPS requires a certificate, and a certificate that requires a fully qualified domain name. The CA/Browser Forum's Baseline Requirements forbid issuing certificates in RFC 1918 private networks (such as 10/8 and 192.168/16) or the mDNS reserved domain (.local). This means everything on the average user's local area network will end up marked "Not Secure", such as the administration interface of the user's router, printer, or network attached storage (NAS) device.
The document "Deprecating Non-Secure HTTP" states that Mozilla is aware of this problem but fails to offer a solution:
Great. How your site won't be browsable at all by default in Firefox until you pony up cash to a certification company.
I guess we know who paid for all those Quantum puff pieces now.
Let's say I'm downloading a file that's several GB, like a disk image. When I download it, I'll verify the signature.
How can you be sure that the SHA-256 value against which you are verifying the disk image hasn't itself been tampered with on its way to your device?
Encrypting the entire download is a waste of resources for both the server and client.
No it isn't. If you fail to encrypt, your ISP, your ISP's ISP, and any snooping government can tell conclusively what you have downloaded. If you do encrypt, the eavesdropper can see only what domain you're accessing and the sizes of what you download. You can obfuscate even the sizes by using range requests to pull the 4 GB disk image a 4 MB chunk at a time.
Plus, hosting providers often charge extra fees for https
Then take your business elsewhere. Switch from a hosting provider that charges extra for HTTPS to a competing hosting provider that does not charge extra for HTTPS.
I guess it depends; but when your rival has about 5 times your market share, you do not matter that much...or do you?
Outstanding. Now how will I disable this problem?
I read at +2. If your post doesn't reach that level I will not see or respond to it.
SSL is a system where one worthless lying corporation (certificate authorities) gets to put a stamp of approval on another corporation (for money, of course - "what could go wrong"!?). I say the whole system sucks balls. I don't trust any of these fuckers. So what if some suit-wearing asshole thinks another suit-wearing asshole is trustworthy. That means exactly zero to me. All the things they check can be forged easily (and have been in several high profile cases). Rather than trust flowing from things & people I trust in reality (ie.. "100 actual friends of mine have ranked this site trustworthy"), the whole system is built on a game of Three Card Monty played by corporate thieves. None of this even touches on the overcomplicated and oft-broken technology at play in SSL (Heartbleed anyone?). While admittedly I don't have a great suggestion for how to fix it, I know what crap looks like when I see it.
The only "certification company" to which you'd need to "pony up cash" is the domain registrar, which you need anyway for a public website. Once you have a domain, you can automate provisioning of certificates issued without charge by Let's Encrypt using an ACME client such as Certbot.
http clearnet = insecure .onion = secure
http cloudflare = insecure TLDR
http
http localhost = secure
http (IP on private network) = secure
else http = insecure
https clearnet = secure .onion = double secure
https cloudflare = insecure TLDR
https
https localhost = warn(selfsign), secure
https (private IP) = warn, secure
else https = secure
I am generally curious why someone would need EVERY site to be secured by https.
What about small businesses who dont offer any downloads or have any contact forms and as such their websites function like a digital flier. Those sites do not really need to have HTTPS certs and actually requiring them (as seems to be the future plans) creates extra burdens on a small company who rarely has a need to touch their web page much less manage certs.
In reference to what seems to be future plans:
https://blog.mozilla.org/secur...
"Q. Does this mean my unencrypted site will stop working?
Not for a long time.Transitioning the web to HTTPS is going to take some time. The first thing weâ(TM)re going to do is require HTTPS for new features. So whatever your website does today, it will still work for months or years."
http (IP on private network) = secure
How so? When your laptop or phone is on restaurant or public library Wi-Fi, you don't know who has 192.168.123.45. This is why the definition of a "potentially trustworthy origin" in the W3C candidate recommendation "Secure Contexts" includes localhost but not RFC 1918 private IP addresses.
Thanks for pouring napalm on the fire.
Let's say I'm downloading a file that's several GB, like a disk image. When I download it, I'll verify the signature. If it's valid, the file is usable. Encrypting the entire download is a waste of resources for both the server and client.
As long as the signature file was delivered over HTTPS and you didn't have any evil root certificate authorities installed on your client, you would be fine. If the insecure download was tampered with, signature verification would fail, as you say.
Encrypting downloads is not that big of a deal resource-wise these days, though. Why not let HTTPS handle MITM detection for you? ;) Most users won't check a sig file anyway.
I mentioned the same planned obsolescence concern in my question to Jacob at Let's Encrypt in an AMA on reddit a year ago.
How is "make and install your own certificates" practical when users bring their own devices, such as public library patrons bringing their laptops or phones to a branch or friends or relatives bringing their laptops or phones to someone's home?
"...when activated will show a visible visual indicator..."
In my 35 years in the computer industry, I have always found that visual indicators that were visible were much more effective than ones that weren't. But then, I'm kind of old-school...
So.. these guys decide to break certificates further and decrease the point of having them to nil. Not only they are no longer doing revocation checking, but they will also nag users so much that the users will just turn this off, or all sites will start using the fake CA let's encrypt that issues certs to anyone for anything, but as they are copying all the bad (end user hurting things) that chrome does, they may as well go ahead and stop showing any information about the certificate chain.. From a point of view of somebody who has vested interest to part you (the end user) with your money, they have no interest into actually providing any security to you. Their vested interest is to present your eyeballs with as many ads per time as possible.. Enter Adam Langley decision to disable revocation in chrome in 2013.
The percentage covers only the subset of users who have opted into Firefox telemetry. If you want to make your votes not count, that choice is yours. Just don't whine when Mozilla cuts your pet feature for lack of usage share justifying the maintenance cost.
You know what cost isn't zero?
Changing the billions of http: links on billions of web pages to billions of other web pages, that's what.
Firefox - and Google, for that matter - are damaging the very integrity of the net, ironically, while claiming to improve it. They're not improving it. This is anal-retentive nonsense. Not everything needs to be encrypted. If something does need to be encrypted, that falls into the realm of the reasonable decision of the page owner, not the web browser author or the search engine.
We've gotten along just fine without this nonsense thus far; I see no reason - other than the use of force by these bad actors - that we should have to arbitrarily change huge portions of the Internet.
You want to encrypt, go ahead. You can if you want. And of course, if you do, it'll be fine. But using force to make you do it... no. That's just evil.
And we know that browser warnings will put people off. This isn't an "otherwise-harmless" act. It'll do real damage.
I've fallen off your lawn, and I can't get up.
Thanks to most of my security addons no longer working, this protection means almost nothing. I have gone to CyberFox.
ftp;//
telnet://
smb://
I got a nice Let's Encrypt certificate than auto-renewed, and I've pushed any external HTTP requests to HTTPS on my router.
And I have a pretty big list of CIDR ranges and URL strings that result in blocked transactions.
It's why a CA can charge hundreds of dollars to perform 50ms of compute effort.
The "50 ms of compute effort" certificates are domain-validated, with just CRL and OCSP as ancillary services. Those typically cost $15 for three years (ssls.com) or nothing for 90 days (letsencrypt.org). The certificates that cost hundreds of dollars are Extended Validation, which ensure not only a connection between the certificate and the domain owner but also that a vandal isn't typosquatting the domain itself. These often come with greater insurance guarantees.
Forge a cert for yourself, it's not hard.
It's a bit harder to get the devices of friends and relatives visiting your home to trust the certificate of your private CA so that they can (say) view the videos on your NAS or print to your printer. In addition, Android displays a persistent warning about "Network monitoring" if a private CA certificate is installed.
Univ. of Michigan, Firefox, and Cisco researchers founded the Let's Encrypt project.
Every Wifi captive portal now wont work as the redirect will fail, coffee shops, guest wifi, all broken, great.
And even doing this, there is still no additional benefit for the servers themselves. Secure the transmission all you like, but if you mess up your server security, then bad-guy (even state actors) don't need to worry about breaking ssl, they can just get all the stuff on the server itself.
Changing the billions of http: links on billions of web pages to billions of other web pages, that's what.
If your HTTPS server sends the Strict-Transport-Security header for one request, the browser will automatically rewrite subsequent requests to http: scheme URLs on the same domain to use the https: scheme instead. If you enable this long-term for all subdomains, you can get the header "preloaded", or included with the browser itself so that even the first request gets rewritten. The HTTPS Everywhere extension by EFF is an additional source of preloads.
Contrary to what the idiots in this comment section are saying. Everything needs to be encrypted. The only way to fight GO/NGO network surveillance is to completely drown out their ability to selectively listen. Encrypt it all and then they'd have to capture, store, and crack all of it to get any analysis done.
>"a red line striking through a classic lock that's normally used to signal the presence of encrypted HTTPS pages"
Really, that sounds OK to me. it is a reasonable warning "for the masses." But ONLY if it stops there. No pop-ups, no dialogs, no animation, no nagging, no striking through the URL, etc.
Not everything needs to be https, and things that aren't are not necessarily any problem. Mozilla can have bonus points by keeping the about:config that allows the user to en/disable the insecure http icon feature.
all sites will start using the fake CA let's encrypt that issues certs to anyone for anything
By the same criteria under which Let's Encrypt is a "fake CA", the vast majority of domain registrars are "fake registrars". They'll issue domains such as bankofarnerica.com to typosquatters and phishers and then not do anything until someone brings action pursuant to UDRP.
When it abuses its trust to put in unwanted extensions like looking glass and pocket. I also expect that all browsers will betray their users eventually, as the temptation to exploit their users becomes too great.
Given Mozilla's track record, they're likely to implement a "next step" three months down the road where everybody is FORBIDDEN from loading non https websites, with no option to override it.
That's just how they roll over at the Mozilla Foundation.
I run software that distributes non-sensitive data across wide area networks... many people at each site want the same data, so I stick a web caching proxy on the site, and the big data (many gigs worth) are all transferred once, and then served from the local caching proxy. encrypting means the caching proxy needs to man-in-the middle, or it's just borked. stupid.
Do they encrypt the URL?
Do they encrypt the web login?
Do they store the obscurity-encrypted passwords in anywhere?
Oh good, now I can pay like $100 a year for an encryption cert that I don't need just to run my static, read-only website that tells people what my business does and where it is and how to contact me. Awesome.
The geniuses at Mozilla decided to hide the http: prefix from the user some time ago, so instead of http://www.cnn.com/ the user sees www.cnn.com
The http: prefix indicates that THERE IS NO ENCRYPTION.
Why hide it from the user and then add a non-standard indicator that there is no encryption?
So many UI designers should be shot...
I find it very strange that browser vendors, first refuse to implement dnssec/dane,
and now want to force everybody to buy an https certificate?!
wonder how much they get in return from the certificate authorities..
This is completely retarded. Not every site needs https.
Given that government agencies have spoofed traffic from sites that are non-encrypted to get at victims suggests otherwise:
As part of the Turmoil system, the NSA places secret servers, codenamed Quantum, at key places on the Internet backbone. This placement ensures that they can react faster than other websites can. By exploiting that speed difference, these servers can impersonate a visited website to the target before the legitimate website can respond, thereby tricking the target's browser to visit a Foxacid server.
* https://www.schneier.com/blog/archives/2013/10/how_the_nsa_att.html
* https://www.itworld.com/article/2702513/it-management/british-spies-reportedly-spoofed-linkedin--slashdot-to-target-network-engineers.html
If you are an employee of an organization that someone wants into, then you are a target. Currently these attacks are state-level, but I wouldn't be surprised that the technology will eventually 'trickle down' to the "merely" criminal.
Trump will make HTTPS illegal soon enough as it hampers american security initiatives
Suppose a small school or social club had a website of 5 pages. Suppose those pages didn't have any user input or financial transactions. Just welcome, about us, a few pictures, and "The next meeting is on Friday, Dec. 22."
That website doesn't need https.
When I click on a link, I expect to be redirected to that link, period
If the link is broken, or if the wait is too long, tell me
But please stop bothering me with 'this is not secure', 'that may be dangerous' crap
Is there a browser that does not annoy users with all the unnecessary craps?
Firefox has become overrun by nannies lately, and is now purposely breaking itself. I've dumped it for Chrome. Not that I'm wild about Chrome, but at least it hasn't become a malfunctioning mess. Say hi to Netscape for us when you reach your destination, Mozilla.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
It does concern me about some of the smaller sites struggling to survive. If a hypothetical site is barely able to pay the server bills, the last thing they need is an additional $15 charge per year (or more) tacked on just to allow a percentage of users to access their site without having users complain about alarms blaring that it's an unsecured site. I mean, sure, $15 a year doesn't sound like much, but if you're not a major site pulling in hundreds off of ad impressions or subscription fees, that seemingly small fee is going to sting on the bottom line. No matter how you slice it, this is going to raise the barrier for entry for new sites.
This added to what is going on with the destruction of network neutrality in the US is almost like pouring salt on the wound. The number of users being able to reasonably access your site may very well drop, but Mozilla decided that web admins need to add another layer of security that come with fees in the process.
Daily read for tech news: Freezenet.ca
Haha... you think they actually give a hoot about that telemetry data? Management makes their decisions and then interprets the telemetry to justify their posisions, no the other way around.
Remember, Microsoft collected huge amounts of telemetry with Windows7. The result was Windows 8.
Has Mozilla hired someone to ruin Firefox? Based on the BS they've done the last months It seems to be the only obvious explanation. Firefox has become an unmitigated disaster. Mozilla, please explain again why I should donate anything.
A browser can be configured to trust a particular CA only if the CA submits all certificates it issues to a Certificate Transparency log. I seem to remember at least Symantec being put in this penalty box.
Pretty sure telemetry was added in Windows 7 after 8 had already launched.
Considering that most companies run MITM attacks against their workers, can we really say that SSL is secure anymore?
What about sites that require no login, and have nothing to do with money?
...a secret configuration option that when activated will show a visible visual indicator...
So I guess with responsive web design, it would be an invisible visual indicator??
run a dynamic dns name
Many domains used by dynamic DNS providers are still not on the Public Suffix List. If a domain is not on the Public Suffix List, Let's Encrypt won't issue more than 20 certificates in a 7-day period for subdomains of that domain. (Source: Let's Encrypt rate limits; Ratelimit for dyndns domain) Instead, the service will produce an error message to the effect:
This means 20 other customers of the same dynamic DNS provider are likely to have already obtained their certificates before you have a chance to.
Once the internet is "secured", what is to prevent CA from shutting down websites they don’t like by simply revoking the certs?
No. A broken lock denotes broken SSL (bad DNS, expired cert, self-signed. you name it). Marking all plaintext sites with some sort of broken lock icon turns firefox into a bad actor.