6 ms·

That makes a lot of sense. HTTPS adoption is now very high[1], and this might push it a little bit further for sites that don't redirect to HTTPS automatically.

by pornel 6y ago

That makes a lot of sense. HTTPS adoption is now very high[1], and this might push it a little bit further for sites that don't redirect to HTTPS automatically. I've been using Firefox in the experimental HTTPS-only mode, and the web is quite usable without cleartext HTTP. [1] https://transparencyreport.google.com/https/overview https://transparencyreport.google.com/https/overview It's not a big change from security perspective though. HTTP requests shouldn't be getting cookies any more, and the redirect isn't revealing anything new (not until we get DoH + ESNI). You still need HSTS preload to defend against active downgrade attacks. An interesting side effect of the change is that sites won't have have a working HTTP redirect any more. Inevitably, there will be sites that let their HTTP versions rot and break, which will eventually force all other web clients to default to HTTPS for web-compatibility.

Ajedi32 6y ago
It seems like this is primarily a performance optimization, at least for now. One less round trip when navigating to a site by typing the domain name when that site redirects to HTTPS (and isn't on the HSTS preload list).
- remram 6y ago
  It's a huge security improvement. The HTTP->HTTPS redirection is not secured in any way. [edit: it's not really because it falls back]
  - est31 6y ago
    The info "is https available" is not secured either. The ISP can just block any packet on port 443 and force http that way. It would break links but wouldn't break people entering the address via the URL bar. A real improvement in security would be Google caching the data, and either offering it via a custom API or just signing it and appending it to their 8.8.8.8 DNS responses. Per default, Chrome already sends the URL to Google as you type, you have to turn auto complete off if you don't want it to happen.
    - xrisk 6y ago
      HSTS preload lists exist. And the scenario where an ISP blocks https connections is unrealistic, the server can simply refuse to serve content on http other than redirects.
      - Ajedi32 6y ago
        We're not talking about preloaded HSTS. In such cases this change makes zero difference; Chrome already would have made the initial connection over HTTPS. And it doesn't matter whether the legitimate server is refusing to serve plaintext HTTP if you're not talking to the legitimate server in the first place. The attacker can serve whatever they want.
      - fomine3 6y ago
        Theoretically ISP can provide a transparent proxy to translate HTTPS to HTTP (but with some feature degradation). It could happen in restricted countries.
      - account42 6y ago
        > HSTS preload lists exist. Unfortunately, you can't be on the HSTS preload lists and have all newer browsers enforce HTTPS while still having a HTTP fallback for legacy systems. In genereal, the backwards compatibility story with HTTPS has been abysmal - it should have never been a new port or URL scheme in the first place.
    - remram 6y ago
      Right, as long as it falls back to HTTP, you don't really increase security. And if you have a side-channel like preloaded HSTS lists the change does not apply. So you're right, it just makes HTTPS sites load faster.
      - est31 6y ago
        Hmm so I thought about it a little and I think the old way allows passive monitoring of the URL within the website while the new way requires active attacks to enable this.
  - deleted 6y ago
    [deleted]
melomal 6y ago
> HTTPS adoption is now very high[1] This is simply because they told SEO's that HTTPs takes precedent and effects ranking - if you want mass adoption of anything then just tell a bunch of SEOs that rankings will be effected (AMP is one that has thankfully not won the fight). Google passed it off as security but I cannot believe this to be the case when you see the shit that litters the Play Store.
- OskarS 6y ago
  What are you even saying? Are you implying that HTTPS is a bad thing because of... SEO? The Play Store? AMP? What is your point exactly?
  - topkeks 6y ago
    Anti-google neckbeards are ready to throw TLS away in their blind rage. What's new?
colllectorof 6y ago
>HTTPS adoption is now very high[1] I posted this in a separate comment and I will post it again. https://certbot.eff.org/hosting_providers https://certbot.eff.org/hosting_providers HTTPS adoption is hard enough that the wast majority of shared hosting providers haven't automated cert provisioning and are delegating this process to their users. The push towards forced HTTPS has significant costs, which most people in this filter bubble don't want to honestly discuss.
- NeutronStar 6y ago
  Over 2/3rd of that list was last audited in 2019. A lot can change in 2 years.
  - jopsen 6y ago
    And most them are probably holding back because they want customers to pay for an SSL certificate.
- silvestrov 6y ago
  This filter bubble are of the very sensible conviction that those hosting providers then need to get their act together or go out of business. HTTPS is old tech. "Let's Encrypt" is free.
  - sharedhostvet 6y ago
    I can tell you from personal experience that they are in the process of going out of business. Traditional shared hosts got their lunch eaten starting almost a decade ago with a combination of site builders like Weebly on the user friendly side and AWS on the technical side. In 2013 most of my social group was friends I made in the shared hosting industry. Now I don't know a single person still working for any MSP as they've all needed to find greener pastures as the companies get bought up by conglomerate vampires that will milk the remaining customers (there aren't many new ones) for what they're worth until the companies finally die. Looking to shared web hosts for guidance is like looking to 2005 to decide what's cutting edge. They're done for. Shared hosting is over. RIP cPanel, Plesk, and the whole lot
fluidcruft 6y ago
The biggest problem I'm having is that our edge firewall doesn't play nicely with it for some reason. I get these random websites that refuse to work in Firefox, but they always work fine in Chrome. And it's not certificate errors, it's just "connection reset by peer". I'm not entirely sure how it's working, but I've seen a few other people with these issues at the mozilla bug tracker and it's always just sort of either ignored or dismissed or people say it's caused by antivirus (which I don't have). I can't figure out how to debug it because literally everything else I try works. curl/wget/etc. I asked IT about it and they just said that I should use Chrome. Firefox just gives a "connection reset by peer" error and literally nothing more. Changing the new firefox security settings has no effect. The exact same url put in chromium or chrome or curl or wget loads fine. I cannot find anything that doesn't work except firefox. So either the firewall is specifically targeting firefox for some (and only some) https sites or there's something going on in firefox. It's literally the only reason I'm considering not using firefox at this point. I've just got no idea what to do or how to debug this. Thankfully, most major sites work fine. But it's annoying when some website blocks off like this.
- hannob 6y ago
  > The biggest problem I'm having is that our edge firewall doesn't play nicely with it for some reason.[...] I'm not entirely sure how it's working, but I seen a few other people with these issues at the mozilla bug tracker and it's always just sort of either ignored or dismissed. This sounds like you have some expensive enterprise equipment that is doing funny things with your TLS connection, but instead of complaining to your enterprise vendor that you likely pay a lot of money to, you complain to an open source project that probably has nothing to do with it.
  - fluidcruft 6y ago
    I mean that's fair, but it's really frustrating that for whatever reason all the other clients work. I just want to figure out what's going on and how the firewall knows to target firefox. Like I said IT's response is "well who cares just use Chrome".
jessriedel 6y ago
As someone with a WordPress blog and static personal site with zero security threats, these changes don't help me at all. They just force me to pay an $150 additional per year to my hosting provider or spend at least a full day figuring out how to reconfigure my SSH certificate to one of the cheap options.
aasasd 6y ago
Funny thing, Linux users clearly lag behind in the adoption, from that graph. You can't even brush it off as ‘who even uses Chrome on Linux’, since it's just the share among whatever users Chrome has there. (Though perhaps those are some weird bozos.) Come to think of it, these might be just devs testing their own non-production sites? Also apparently Google supports the movement of barely readable text on the web.

by pornel 6y ago

Ajedi32 6y ago

It seems like this is primarily a performance optimization, at least for now. One less round trip when navigating to a site by typing the domain name when that site redirects to HTTPS (and isn't on the HSTS preload list).

remram 6y ago
It's a huge security improvement. The HTTP->HTTPS redirection is not secured in any way. [edit: it's not really because it falls back]
- est31 6y ago
  The info "is https available" is not secured either. The ISP can just block any packet on port 443 and force http that way. It would break links but wouldn't break people entering the address via the URL bar. A real improvement in security would be Google caching the data, and either offering it via a custom API or just signing it and appending it to their 8.8.8.8 DNS responses. Per default, Chrome already sends the URL to Google as you type, you have to turn auto complete off if you don't want it to happen.
  - xrisk 6y ago
    HSTS preload lists exist. And the scenario where an ISP blocks https connections is unrealistic, the server can simply refuse to serve content on http other than redirects.
    - Ajedi32 6y ago
      We're not talking about preloaded HSTS. In such cases this change makes zero difference; Chrome already would have made the initial connection over HTTPS. And it doesn't matter whether the legitimate server is refusing to serve plaintext HTTP if you're not talking to the legitimate server in the first place. The attacker can serve whatever they want.
    - fomine3 6y ago
      Theoretically ISP can provide a transparent proxy to translate HTTPS to HTTP (but with some feature degradation). It could happen in restricted countries.
    - account42 6y ago
      > HSTS preload lists exist. Unfortunately, you can't be on the HSTS preload lists and have all newer browsers enforce HTTPS while still having a HTTP fallback for legacy systems. In genereal, the backwards compatibility story with HTTPS has been abysmal - it should have never been a new port or URL scheme in the first place.
  - remram 6y ago
    Right, as long as it falls back to HTTP, you don't really increase security. And if you have a side-channel like preloaded HSTS lists the change does not apply. So you're right, it just makes HTTPS sites load faster.
    - est31 6y ago
      Hmm so I thought about it a little and I think the old way allows passive monitoring of the URL within the website while the new way requires active attacks to enable this.
- deleted 6y ago
  [deleted]

melomal 6y ago

> HTTPS adoption is now very high[1] This is simply because they told SEO's that HTTPs takes precedent and effects ranking - if you want mass adoption of anything then just tell a bunch of SEOs that rankings will be effected (AMP is one that has thankfully not won the fight). Google passed it off as security but I cannot believe this to be the case when you see the shit that litters the Play Store.

OskarS 6y ago
What are you even saying? Are you implying that HTTPS is a bad thing because of... SEO? The Play Store? AMP? What is your point exactly?
- topkeks 6y ago
  Anti-google neckbeards are ready to throw TLS away in their blind rage. What's new?

colllectorof 6y ago

>HTTPS adoption is now very high[1] I posted this in a separate comment and I will post it again. https://certbot.eff.org/hosting_providers https://certbot.eff.org/hosting_providers HTTPS adoption is hard enough that the wast majority of shared hosting providers haven't automated cert provisioning and are delegating this process to their users. The push towards forced HTTPS has significant costs, which most people in this filter bubble don't want to honestly discuss.

NeutronStar 6y ago
Over 2/3rd of that list was last audited in 2019. A lot can change in 2 years.
- jopsen 6y ago
  And most them are probably holding back because they want customers to pay for an SSL certificate.
silvestrov 6y ago
This filter bubble are of the very sensible conviction that those hosting providers then need to get their act together or go out of business. HTTPS is old tech. "Let's Encrypt" is free.
- sharedhostvet 6y ago
  I can tell you from personal experience that they are in the process of going out of business. Traditional shared hosts got their lunch eaten starting almost a decade ago with a combination of site builders like Weebly on the user friendly side and AWS on the technical side. In 2013 most of my social group was friends I made in the shared hosting industry. Now I don't know a single person still working for any MSP as they've all needed to find greener pastures as the companies get bought up by conglomerate vampires that will milk the remaining customers (there aren't many new ones) for what they're worth until the companies finally die. Looking to shared web hosts for guidance is like looking to 2005 to decide what's cutting edge. They're done for. Shared hosting is over. RIP cPanel, Plesk, and the whole lot

fluidcruft 6y ago

The biggest problem I'm having is that our edge firewall doesn't play nicely with it for some reason. I get these random websites that refuse to work in Firefox, but they always work fine in Chrome. And it's not certificate errors, it's just "connection reset by peer". I'm not entirely sure how it's working, but I've seen a few other people with these issues at the mozilla bug tracker and it's always just sort of either ignored or dismissed or people say it's caused by antivirus (which I don't have). I can't figure out how to debug it because literally everything else I try works. curl/wget/etc. I asked IT about it and they just said that I should use Chrome. Firefox just gives a "connection reset by peer" error and literally nothing more. Changing the new firefox security settings has no effect. The exact same url put in chromium or chrome or curl or wget loads fine. I cannot find anything that doesn't work except firefox. So either the firewall is specifically targeting firefox for some (and only some) https sites or there's something going on in firefox. It's literally the only reason I'm considering not using firefox at this point. I've just got no idea what to do or how to debug this. Thankfully, most major sites work fine. But it's annoying when some website blocks off like this.

hannob 6y ago
> The biggest problem I'm having is that our edge firewall doesn't play nicely with it for some reason.[...] I'm not entirely sure how it's working, but I seen a few other people with these issues at the mozilla bug tracker and it's always just sort of either ignored or dismissed. This sounds like you have some expensive enterprise equipment that is doing funny things with your TLS connection, but instead of complaining to your enterprise vendor that you likely pay a lot of money to, you complain to an open source project that probably has nothing to do with it.
- fluidcruft 6y ago
  I mean that's fair, but it's really frustrating that for whatever reason all the other clients work. I just want to figure out what's going on and how the firewall knows to target firefox. Like I said IT's response is "well who cares just use Chrome".

jessriedel 6y ago

As someone with a WordPress blog and static personal site with zero security threats, these changes don't help me at all. They just force me to pay an $150 additional per year to my hosting provider or spend at least a full day figuring out how to reconfigure my SSH certificate to one of the cheap options.

aasasd 6y ago

Funny thing, Linux users clearly lag behind in the adoption, from that graph. You can't even brush it off as ‘who even uses Chrome on Linux’, since it's just the share among whatever users Chrome has there. (Though perhaps those are some weird bozos.) Come to think of it, these might be just devs testing their own non-production sites? Also apparently Google supports the movement of barely readable text on the web.