5 ms·

Great to see this built into firefox, I have been using HTTPS Everywhere https://www.eff.org/https-everywhere https://www.eff.org/https-everywhere to achieve si

Great to see this built into firefox, I have been using HTTPS Everywhere https://www.eff.org/https-everywhere https://www.eff.org/https-everywhere to achieve similar results, it won't warn you if it is not https (i think) but it will try and upgrade to https if it can. It is available for chrome and firefox. What particularly annoyed me was using http to sites which supported https.

AlexSW 6y ago
For me at least it warns me very blatantly and I have to asked to go to an insecure site if it's HTTP only. Perhaps we don't have the same configuration.
- akalsz 6y ago
  That's not enabled by default, you first have to flip the "Encrypt All Sites Eligible" switch.
jabl 6y ago
IIRC HTTPS Everywhere works by having a whitelist of domains that are also accessible over https, and switches to https for those. So if a site isn't in the whitelist, it won't modify the request in any way.
- zapt02 6y ago
  HTTPS Everywhere will attempt to connect to a site using SSL, and if that times out will pop out an error message and allow you to load the site over HTTP temporarily. At least that's how it works on Firefox + latest version of the extension.
  - cmeacham98 6y ago
    Only if you have the "encrypt all elgible sites" option enabled, which is disabled by default.
mxcrossb 6y ago
I remember years ago when Facebook wasn’t using https and a bunch of articles came out with how to access someone’s account if you’re both on unencrypted public wifi. Since then I’ve been a fan of https everywhere
- jannes 6y ago
  IIRC this was around the time when someone created Firesheep [0] which made it really easy to steal unencrypted session cookies via packet sniffing, which sparked all those articles you are talking about. [0]: https://en.wikipedia.org/wiki/Firesheep https://en.wikipedia.org/wiki/Firesheep
pabs3 6y ago
HTTPS Everywhere already supports a HTTPS-only mode called EASE, it is opt-in though.
thamer 6y ago
The Brave browser has this feature built-in, by the way (Settings > Shields > Upgrade connections to HTTPS [X])
st1ck 6y ago
As others pointed out, you can set it up to always upgrade to HTTPS and warn you when it's not supported. But that's not gonna work all the time: some websites will have self-signed certificates (which is better that nothing I guess), some will return 403 or 404 (for HTTPS only), some will just not load after trying for half a minute.

AlexSW 6y ago

For me at least it warns me very blatantly and I have to asked to go to an insecure site if it's HTTP only. Perhaps we don't have the same configuration.

akalsz 6y ago
That's not enabled by default, you first have to flip the "Encrypt All Sites Eligible" switch.

jabl 6y ago

IIRC HTTPS Everywhere works by having a whitelist of domains that are also accessible over https, and switches to https for those. So if a site isn't in the whitelist, it won't modify the request in any way.

zapt02 6y ago
HTTPS Everywhere will attempt to connect to a site using SSL, and if that times out will pop out an error message and allow you to load the site over HTTP temporarily. At least that's how it works on Firefox + latest version of the extension.
- cmeacham98 6y ago
  Only if you have the "encrypt all elgible sites" option enabled, which is disabled by default.

mxcrossb 6y ago

I remember years ago when Facebook wasn’t using https and a bunch of articles came out with how to access someone’s account if you’re both on unencrypted public wifi. Since then I’ve been a fan of https everywhere

jannes 6y ago
IIRC this was around the time when someone created Firesheep [0] which made it really easy to steal unencrypted session cookies via packet sniffing, which sparked all those articles you are talking about. [0]: https://en.wikipedia.org/wiki/Firesheep https://en.wikipedia.org/wiki/Firesheep

pabs3 6y ago

HTTPS Everywhere already supports a HTTPS-only mode called EASE, it is opt-in though.

thamer 6y ago

The Brave browser has this feature built-in, by the way (Settings > Shields > Upgrade connections to HTTPS [X])

st1ck 6y ago

As others pointed out, you can set it up to always upgrade to HTTPS and warn you when it's not supported. But that's not gonna work all the time: some websites will have self-signed certificates (which is better that nothing I guess), some will return 403 or 404 (for HTTPS only), some will just not load after trying for half a minute.