5 ms·
> HTTPS-First Policy: Firefox Private Browsing windows now attempt to make all connections to websites secure, and fall back to insecure connections only when w
by nanis 5y ago
> HTTPS-First Policy: Firefox Private Browsing windows now attempt to make all connections to websites secure, and fall back to insecure connections only when websites do not support it.
Hmmmm ... Does this mean "HTTPS Everywhere" is no longer needed?[1]
And, of course, it freaks out with the previously saved self-signed cert installed on my WiFi router. ... sigh
[1]:https://www.eff.org/https-everywhere https://www.eff.org/https-everywhere
- toyg 5y ago> Firefox Private Browsing windows now attempt to make all connections to websites secure Ah yes, I don't want anyone to eavesdrop on my pr0n! Edit: to clarify, I find it weird that this has been limited to Private Browsing, when most people don't even use it for anything but adult websites. The feature is good and should be available for regular browsing too.
- yjftsjthsd-h 5y agoDo you have traffic that you are okay with people watching? Because I personally have exactly zero traffic that I want my ISP to know about (and then resell that info to ad companies, ex. https://www.infoworld.com/article/2608352/internet-privacy-another-privacy-threat-dns-logging-and-how-to-avoid-it.html https://www.infoworld.com/article/2608352/internet-privacy-a...).
- toyg 5y agoI agree wholeheartedly - that's why I found puzzling that the functionality has been limited to "porn-mode". Judging by the downvotes though, I should have stated it better.
- yjftsjthsd-h 5y agoOh, yes now I can see what you meant. Forgot that private mode was called porn mode, especially since in my brain it's more like "safe mode" to run without extensions or cookies:)
- ilikepi 5y ago> Edit: to clarify, I find it weird that this has been limited to Private Browsing, when most people don't even use it for anything but adult websites. The feature is good and should be available for regular browsing too. It can be enabled for all windows, but it was not enabled at all when the feature was first rolled out in v83. Presumably they wanted to allow time for any bugs to be shaken out before imposing it by default in any circumstance. It seems plausible they could enable it in regular windows as well in the future.
- PoignardAzur 5y agoI had the same thought. Best guess, they're doing it as a large scale canary. That way they can roll it out to all Firefox users, and if something breaks, users can always fall back to non-private mode until it's fixed.
- q3k 5y agoI hope it's not. The assumption that whatever is being served on :443 is HTTPS with the same content as what is being served on :80 HTTP is wrong. It might practically be true >99% of the time, but some websites will still break for no good reason.
- Dylan16807 5y agoTLS is a good reason.
- yjftsjthsd-h 5y ago> Does this mean "HTTPS Everywhere" is no longer needed? Probably not quite - I can't easily find an exact reference, so take with a grain of salt, but my recollection is that HTTPS Everywhere includes some slightly more sophisticated transforms (ex. for annoying sites that serve http://www.site.tld http://www.site.tld but HTTPS on https://secure.site.tld https://secure.site.tld).
- forgotpwd16 5y agoYes, HTTPS Everywhere is more robust. The straightforward route taken here is closer to Smart HTTPS. But better just use HTTPS only mode and disable it whenever a problematic site appears.
- lucideer 5y agoFWIW in addition to this they also added an (off-by-default) "HTTPS Only Mode"[0] to Firefox settings recently, which I've been using instead of HTTPS Everywhere. It's not as powerful/flexible/configurable, but certainly ticks some of the boxes. [0] https://support.mozilla.org/en-US/kb/https-only-prefs https://support.mozilla.org/en-US/kb/https-only-prefs