3 ms·
Something like that. By default, HTTPS Everywhere uses a list of HTTPS-capable sites. It doesn't automatically HTTPS-ize the sites outside of that list or bloc
by bilegeek 6y ago
Something like that.
By default, HTTPS Everywhere uses a list of HTTPS-capable sites. It doesn't automatically HTTPS-ize the sites outside of that list or block HTTP connections. You have to click the "Encrypt All Sites Eligible" option for that, and only then will it throw an error if the site doesn't have an HTTPS version.
Tor Browser doesn't have this enabled by default, probably because hidden services don't require HTTPS and it would be a pain as a default.
- hcs 6y agoEncrypt All Sites Eligible doesn't prevent http to .onion sites. See the check here: https://github.com/EFForg/https-everywhere/blob/bcaf7bdecf147c2a46d7ed73bce64389d828d865/chromium/background-scripts/background.js#L370 https://github.com/EFForg/https-everywhere/blob/bcaf7bdecf14... Edit: Which is not to say that there aren't rules forcing some .onion sites to https, there are. Encrypt All Sites Eligible (httpNowhereOn) just knows it doesn't have to worry about un-rewritten http .onion addresses. So it really is a good idea to turn it on, and think hard before allowing an exception.
- bilegeek 6y agoHuh. TIL. I guess it also depends on your threat model. If you are only browsing and in "Safest" mode, I suppose it's tolerable. But I agree that logging into anything requires EASE to be on.