4 ms·
One change I'd like to see in browsers is when the user enters a domain without protocol in the url bar it interprets that as https instead of http.
by CodesInChaos 6y ago
One change I'd like to see in browsers is when the user enters a domain without protocol in the url bar it interprets that as https instead of http.
- gostsamo 6y agoThis is exactly the https mode.
- josephcsible 6y agoThe difference is what happens if you type http manually.
- jefftk 6y agoOr click on an http:// http:// link
- CodesInChaos 6y agoI don't think so. My proposed change only affects manually entered urls without protocol/schema. HTTP urls (entered manually or from links) would still work as expected, while https mode blocks them. I believe this change is small enough that they can make it the default, while http mode will likely remain optional for several years.
- joveian 6y agoThey can't make it the default yet without breaking a lot of things since a bunch of marketing people decided to break the security properties of TLS by using HTTP only vanity redirect domains. While I've found HTTP-only to be most common, sometimes these redirects do support HTTPS but hand out the main site certificate without updating it to include the vanity domain, resulting in a certificate error (however, this new built in HTTPS only gives you a HTTP warning in this case rather than a certificate error, unlike HTTPS Everywhere's EASE). Some sites also have HTTP only redirect from example.com to www.example.com.
- kccqzy 6y agoThat would break tons of intranet applications for many enterprises.
- proactivesvcs 6y agoI tried out the "HTTPS Everywhere" Firefox extension but found it cause me more trouble than it was worth, then found "HTTPS By Default" which suits my use much better. It automatically requests all awesomebar requests to https:// https:// by default; one can manually use http:// http:// to bypass it.