12 ms·
HTTPS Everywhere will sunset in January 2023
- nullbytesmatter 4y agoGreat news. Now the only required extensions are an ad blocker, tamper monkey, no script, multi-account containers, container proxy, tree style tabs and auto tab discard.
- sharmin123 4y ago
- theandrewbailey 4y agoThat was a good extension for a specific time. I stopped using it about 5 years ago when everyone had been pushing HTTPS hard, and Let's Encrypt had become popular. I didn't notice any websites not using HTTPS, so I didn't look back.
- bombcar 4y agohttp://neverssl.com http://neverssl.com remains for those badly-setup wifi networks.
- silviot 4y agoThanks! I'll stop using captive.apple.com now that I know about this!
- robjan 4y agoYou can also use example.com. I find that easier to remember.
- tialaramex 4y agoThe example names are just examples, it so happens that today they have a web site and it isn't HSTS. Tomorrow maybe they have HSTS. The week after maybe they get rid of the web site. The names are merely examples, and so it's probably a bad idea to use them for any other purpose.
- doliveira 4y agoCool, they even generate subdomains dynamically to avoid caching
- lambda_matt 4y agoBeat me to it. beats the hell out portscanning the subnet at the airport
- RealStickman_ 4y agoOr alternatively http://httpforever.com/ http://httpforever.com/
- rav 4y agoSimilar to HTTPS-only being built into web browsers, isn't captive portal detection built into all modern OSes? What's the badly-setup wifi network that requires you to open your browser but doesn't get detected properly by the OS as a captive portal?
- notatoad 4y agoit isn't so much "badly" set up as maliciously set up. Captive portal vendors like to find ways of defeating the operating system's captive portal detection, because it hinders their ability to show ads after the captive portal login process.
- deleted 4y ago[deleted]
- deleted 4y ago[deleted]
- eslaught 4y agoIt's funny that if I navigate to this site with HTTPS-only mode, it redirects to an HTTPS page.
- _tki0 4y agohttps://twitter.com/NeverSSL/status/1456310362551164928 https://twitter.com/NeverSSL/status/1456310362551164928
- viraptor 4y agoThere are still places that don't auto-redirect to https for some reason. Maybe a temporary misconfiguration. I just ran into http://www.mbsonline.gov.au http://www.mbsonline.gov.au today and was surprised it didn't redirect and has broken https, even though that org really shouldn't do that.
- necovek 4y agoA redirect itself is considered bad by some because it encourages relying on http in the first place (imagine always hitting a web site through http and expecting a redirect instead of going to https directly). As soon as you do that, you are similarly prone to MITM attacks: on an insecure network, you hit an http site and it replaces the redirect with one to a https site that looks like the same domain but really isn't (with a valid cert for mbsonline.gov.au.foo.io). For my personal sites, I prefer to go with no redirects and if it really processes data, https-only. For users, the right solution isfor browsers to always attempt https first even if those could be technically serving entirely different content (that would be one hell of an anti-pattern though, so I wouldn't worry about it).
- marcosdumay 4y agoA permanent redirection before setting the correct headers is the best you can do at the server side. Yes, the user is using insecure practices, and no, you can't correct it on your server.
- necovek 4y agoI am arguing that the best you can do is not even have HTTP enabled. A permanent redirect is the second best ;) And yeah, most practical for commercial entities (which is why I highlighted what I do for my personal sites).
- C4K3 4y agoThe best you can do is set HSTS and redirect from http to https. You not serving http won't prevent a MITM from serving http to the victim.
- Dunedan 4y agoOne website not supporting HTTPS which caught my eye is http://paulgraham.com/ http://paulgraham.com/
- kevincox 4y agoI've been using HTTPS-only mode on Firefox for many months now. The place where I see HTTP links most often is email tracking links. I'm commonly automatically upgraded to HTTPS and it works but very often there is no HTTPS support at all. Even for sensitive things like password resets that have secret tokens in the URL.
- tialaramex 4y agoA few sites I run into once in a while have the following bad setup, which HTTPS-only flags (because it's actually unsafe) but looks normal to most people: 1. http://www.example.com/ http://www.example.com/ exists and redirects to http://example.com/ http://example.com/ 2. http://example.com/ http://example.com/ also exists and redirects to https://example.com/ https://example.com/ 3a https://example.com/ https://example.com/ works fine but 3b https://www.example.com/ https://www.example.com/ does not exist 4. External links go to http://www.example.com/stuff/goes/here http://www.example.com/stuff/goes/here You will also see the mirror image mistake (www.example.com is canonical, but the redirects go from example.com only on HTTP) at similar rates. This is all because Tim chose not to rely on SRV records to make his toy hypermedia system work and decades later we're still paying for this (among others) mistake.
- Lanley 4y agoI'm surprised by the number of German websites (.de) I've encountered this year that don't support HTTPS. I think they're all small businesses or personal sites, but still unexpected.
- Taywee 4y agoThis is the kind of sunset you love to see. Retirement because they succeeded and therefore became redundant, rather than due to failure. If there's one organization I love to see succeed, it's the EFF.
- user3939382 4y agoThat’s how I used to feel until I found out they accepted millions in donations from companies like Google and Facebook/their executives/their executives’ charities. I’m just some guy on the Internet but IMHO their being OK with massive conflicts of interest means I no longer trust them.
- metacritic12 4y agoSerious question: is there a popular charity that by rule doesn't accept donations from really rich people?
- cbozeman 4y agoThen nut up and donate the millions yourself.
- yjftsjthsd-h 4y agoThat doesn't follow. Do you really want to argue that the only way someone is allowed to disagree with millionaires is by being one themselves?
- blowski 4y agoWhat's the EFF to do? 1. Achieve its mission with no money, or 2. Find money from sources deemed acceptable, or 3. Take money from sources deemed unacceptable I'm OK with option 3, so long as its transparent, because I agree with the agenda the EFF are pushing. If they start pushing an agenda I disagree with, I'll stop supporting them, whether or not they receive money from Google et al.
- yuliyp 4y ago
- zagrebian 4y agoCan we also sunset animated GIFs, while we’re at it?
- DizzyDoo 4y agoThere's a piece of animation software that I use in my game development called Spine, and it's truly fantastic and the developers and staff are great... but the PHPBB forums don't have https enabled. I've brought it up on these same forums[0] but I don't think they get why https is an important thing to turn on, even in 2022. Turning on https mode in my browser brings up, as it should, a large error message saying that the site is insecure. I can't imagine that's a terribly good first impression, even though, again, Spine is one of the best animation packages out there. [0] - http://esotericsoftware.com/forum/HTTPS-for-EsotericSoftware-com-17472 http://esotericsoftware.com/forum/HTTPS-for-EsotericSoftware...
- cmeacham98 4y agoNot only do the forums have HTTPS disabled, but they expect you to download executables to run on your computer over HTTP. And, the kicker: they already have a legit HTTPS cert for the entire site: visiting on HTTPS redirects you to HTTP _facepalm_. Never heard of Spine before your comment, but if I found this in the wild I'd assume it was amateur hour and turn back immediately.
- DizzyDoo 4y agoA slight correction here, the download of the exe does take place over https. As does buying the software, and signing up to the forums. But everything else doesn't? The software itself is some of the smoothest and most stable I've ever used. And when there's an update within the software that, as far as I'm aware, takes place over https too. But the rest of the site and forums, even when signed in, is http, and I don't really know why.
- wlesieutre 4y agoThe download itself is over https, but the page where you click the download link is http. If someone were going to MITM the executable, they can just MITM the download page instead and point the download button to their own server with the bad executable.
- junon 4y agoGreat job on this. The sunset in this case means it worked. Everyone benefits from the work done here and will continue to do so. Love to see it!
- boneitis 4y agoInteresting. Just a couple hours ago, I was reading their post (2016) on how they were sunsetting their canary watch program, saying that it had achieved the goals they had set out on for it (internally, my knee-jerk reaction was "...what?"). Of course, I'm not as incredulous this time around over HTTPS Everywhere. https://www.eff.org/deeplinks/2016/05/canary-watch-one-year-later https://www.eff.org/deeplinks/2016/05/canary-watch-one-year-...
- _8j50 4y agoI think it still has value. A lot of sites have https but users or resource-fetch from them over http is still not redirected to https. If the internet is navigable while blocking plain http on your host firewall, then we don't need this. But I do get it takes time and resources to maintain their list.
- kevincox 4y agoThe article talks about how to get this HTTPS by default functionality in all major browsers. I don't see how your complaint about not being redirected to HTTPS is relevant with those settings enabled.
- jwilk 4y agoThere's still plenty of useful websites that are HTTP-only or that have HTTPS misconfigured. The HTTPS-only mode will break them, whereas HTTPS Everywhere just works.
- thebeardisred 4y ago+1. I was having this sort of issue setting up an Android tablet as a wifi CNC pendant. The controller is based on an ESP32 (which has limited storage for a full cert chain) and I run it without a gateway address on it's own VLAN. I'm certain it's "secure enough". Turns out Android + Firefox mobile keeps trying to turn "http" to "https" and at the same time specifying the IP + port explicitly in the URL is considered malicious by Firefox. "This address uses a network port which is normally used for purposes other than Web browsing. Firefox has canceled the request for your protection." I had to run a development version of Firefox just to be able to get to "about:config" to disable the behavior.
- tialaramex 4y agoBut why pick a port that's never traditionally used for HTTP ? Firefox isn't just assuming all ports are prohibited, it has a relatively short list of ports where we know it's crazy to pick HTTP on those ports and sometimes people do it to exploit protocol parsing issues, so it forbids that.
- lapcat 4y agoIt doesn't seem to be mentioned by the EFF, but coincidentally, January 2023 is when Manifest v2 extensions stop working in Google Chrome: https://developer.chrome.com/blog/mv2-transition/ https://developer.chrome.com/blog/mv2-transition/
- jacooper 4y agoAnd its going to be a very big moment, since V3 effectively bans Adblockers and website redirect extensions. It might increase Firefox adoption if it actually happens.
- nullbytesmatter 4y agoYou do realize Firefox is going to V3 as well?
- lapcat 4y agoFirefox is adding V3 support for compatibility with Chrome but not removing V2 support: https://blog.mozilla.org/addons/2022/05/18/manifest-v3-in-firefox-recap-next-steps/ https://blog.mozilla.org/addons/2022/05/18/manifest-v3-in-fi...
- nullbytesmatter 4y agoThat's what they say now, they don't exactly have a good extension record themselves. I operate some popular extensions and I now maintain a v2 and v3 build (make file). I'd love to nuke the v2 build tasks and only operate in v3. Most users are on Chrome anyway. If you're lucky, v2 will be kept around for legacy extensions that are rarely if ever updated.
- mmis1000 4y agoV3 and request modification banned are two different things. The chrome still support request modification in v3 but disallow extension to use it(only allow enterprise policy or whatever to enable it). While firefox don't have plans like this (so far).
- superkuh 4y agoHTTPS Everywhere being available in browsers as an option is great. HTTPS Everywhere being promoted as something you should have on by default is bad. HTTPS, like much else, relies on incorporated entities as certificate authorities. And that's fine for commercial interactions and if browsers were only for interacting with businesses. But by a combination of centralization in a few CAs (everyone uses LetsEncrypt now) and browsers shipping HTTPS only we are now entering an age when you can only host a visitable website on the continued temporary whim of some external corporation. LE may be a benign dictator for now, just like dot Org was, but the more people that use it and the more centralized it becomes in all interactions the greater pressures will be put on it re: corruption from within and political attack from without to allow some but not others. HTTP only is okay. HTTP+HTTPS is great. HTTPS-only is the end of the web for human persons and the beginning of the commercial only web.
- DANK_YACHT 4y agoHTTP is not ok. Anyone can ready / modify what is being sent. This privacy intrusion will definitely happen, whereas the risk of being banned by "some external corporation" is low. And, you always have the option of self-signing your own certificate, which is at least as secure as using HTTP, and much more secure if you can verify the certificate via a side channel.
- ZWoz 4y ago> HTTP is not ok. Anyone can ready / modify what is being sent. How do you plan demonstrate that in my local network, connection between my computer and printer web based interface? Generally, we had several decates HTTP as main protocol and that worked out.
- DANK_YACHT 4y agoThe underlying assumption is that we're talking about the internet, not a private network, but even your private network would benefit from encryption. What is the benefit of having anyone with access to your network potentially read / modify your network traffic?
- srvmshr 4y agoNoob question: If I have a personal HTTP website running out of GCP cloud storage (without the load balancer, bells & whistles), is it possible to upgrade it to HTTPS so that visitors don't get warnings
- Minor49er 4y agoLooks like you can either do this by referencing static pages with HTTPS directly or by putting a load balancer in front of your site: https://cloud.google.com/storage/docs/troubleshooting#https https://cloud.google.com/storage/docs/troubleshooting#https My shared hosting provider (Cooini) gives an HTTPS option out of the box. It used to be a paid option that required upgrading to dedicated hosting, but they changed it years ago to a simple cost-free toggle in their dashboard
- alanh 4y agoWhew, for a sec I confused HTTPS Everywhere with Let’s Encrypt! I’m glad Let’s Encrypt isn’t going anywhere :)
- AtNightWeCode 4y agoIs https enough or do we also need hsts? And how does QUIC fit into all of this?
- bastawhiz 4y agoPretty much all browsers will try HTTPS first if you type a URL without a protocol. HSTS only practically helps in the case where you have URLs that have the wrong protocol. QUIC and H2 are both always encrypted. But since quic is purely supplemental at this point, it really doesn't factor into anything relevant here.
- philsnow 4y agoThe reason to use https is because we assume there could be a malicious party between you and the site you're visiting. If we assume that, we should further assume that they will inspect SNI in your https request, see that you're visiting some domain they are interested in, and just block that request (or creatively fail to make a good https connection, to arouse less suspicion), causing your browser to helpfully fall back to plain http. But this is exactly the behavior we don't want. HSTS (or firefox's force https setting, probably similar settings exist for other browsers, or HTTPS Everywhere's strict setting) makes your browser insist on using https for connections to that domain, and showing an error page if it's not possible.
- AtNightWeCode 4y agoWhat I don't get is what is the purpose of HSTS if HTTPS is enforced in the first place. Several (most?) security checkers will warn if HSTS is not enabled for a site. From the tests I have done it seems impossible to get QUIC and HSTS to even work on the same site.
- tialaramex 4y ago> From the tests I have done it seems impossible to get QUIC and HSTS to even work on the same site. I don't understand, maybe you need to explain "the tests I have done" here ?
- bborud 4y agoNow, if only we could become better at securely managing keys.