Firefox 76 to Offer HTTPS-Only Connections
nakedsecurity.sophos.com/2020/03/27/firefox-7...Posted Mar 30, 2020, 7:35 PM UTC
26531
nakedsecurity.sophos.com
Sooooo “HTTPS everywhere”, just baked-in?
29
Good for folks who don’t know what HTTPS Everywhere even is or opt to use the browser without extensions. Security by default.
Additionally it will help reduce fingerprinting for those who do use that extension, since requesting HTTPS for images/scripts/etc. currently increases browser uniqueness for you and I.
Lastly, I’m guessing this will make its way to Tor Browser, freeing its developers from having to maintain a fork of HTTPS Everywhere bundled with the browser.
27
That's actually wonderful. Common sense stuff like this should be absorbed as to avoid issues that come with separate development teams maintaining various different tools.
5
[deleted]
0
Does this mean that, upon this feature's release, HTTPS Everywhere can be uninstalled?
5
[deleted]
3
Hopefully this time Mozilla will take security into consideration and their implementation is more reasonable than just adding a new CSP header.
1
They recently rolled out a change making all DNS traffic move over SSL. This caused a lot of our customers firewalls/our firewalls to alert, as abnormal traffic was moving over the dns port. We had to change some FW rules to get it to stop alerting.
13
as abnormal traffic was moving over the dns port.
But it doesn't use the dns port, it uses https port 443...
17
Ah, maybe I'm remembering incorrectly. Idk some change they made with firefox caused it.
4
Didn’t they actually enabled by default DNS Over HTTPS for American users not long ago ? I think that was that possibly
4
[deleted]
2
That sounds about right.
0
They likely use DPI, and a good IPS is going to block a sudden spike in tunneled dns over tls.
-2
Thought that said Fallout 76 and I was so confused.
Also interested to see how they roll out the new change.
8
I see that Firefox is trying to be secure browser standard. An I think that it's a good goal because Chrome can't be such browser.
2
Does this matter if you use the HTTPS Everywhere extension?
Though anyways it's neat if this helps people who don't know about it as well of course.
1
Wait.. I have the https everywhere plugin already, so they are saying that my ISP couldn't see my browsing all this time? 😂😂😂😂
-30
[deleted]
21
Close. With an SSL connection your ISP can only see the IP address that you are making a request from. Some IPs may host multiple sites and the ISP can't tell which one you are interacting with. Then there's also the issue of CDNs such a CloudFlare...
16
Iirc that's only with esni Idk how common esni is but there are still https sites where the isp can see the domain you are connecting too.
14
You are correct. I've actually looked it up twice this week, so I'm quite confident I'm remembering it correctly.
3
0.o
0
So likeeee..basically if I were to go to a porn site - they won't be able to know what kind of porn I like? 😂😂
-6
If the website is called goatpornography.com they can probably work it out.
11
Not necessarily... So the page might be HTTPS but the elements on it might be sent over HTTP. This is a common issue with sites using media like pictures and videos. If they're designed well then you're fine. If you're really concerned then get a VPN. It adds another layer and if they are trustworthy then even they won't know what you're doing.
10
HTTPS Everywhere's default behavior is to enforce TLS for a community-maintained list of domains. All it is (until you enable its force https option) is an extended HSTS preload list.
9
I have that option enabled :))
0
Is there an about:config preference to enable this on nightly?
[deleted]
It has that, but don't use the option that comes with HTTPS Everywhere together with any other security/privacy add-on like uBlock and especially uMatrix/NoScript.
Mozilla still hasn't fixed their Content Security Policy header merging bug and setting HTTPS Everywhere to encrypt all sites will cause conflicts with other extensions, potentially allowing websites to execute JS despite the user thinking uMatrix is stopping that. Generally HTTPS Everywhere can be used without issues, it's just the option to encrypt all websites that modifies CSP headers.
Better yet, if you want to be sure all addons are working as intended switch away from Firefox to Vivaldi or Brave. Mozilla clearly doesn't care about user's security being undermined.
[deleted]
I agree, this is one of the easiest takes on this debacle, this was already linked in my post.
As someone who doesn't completely understand all of this, I did a bad thing getting Mozilla? I dropped chrome for it because it seemed like the way to go. Are the other options good?
It's definitely better than Chrome and Chromium, (I'd say worse than Vivaldi, but that's personal preference), but the CSP headers issue only affects people who use a specific set of add-ons. If you do not use more than 1 of the add-ons I've mentioned you most likely do not need to worry.