3 ms·

Good point. I borrowed a computer that had "HTTP Nowhere" installed on Firefox, but that seemed to break a lot of things to the point I had to turn it off. That

by ejr 12y ago

Good point. I borrowed a computer that had "HTTP Nowhere" installed on Firefox, but that seemed to break a lot of things to the point I had to turn it off. That may explain why browsers still default to http.

quesera 12y ago
HTTPS Everywhere works great, all the time, for me. I've never heard of "HTTP Nowhere". If you were just misremembering the name, it might have been a long ago old version? Or maybe the borrowed computer was otherwise jacked.
- ejr 12y ago
  It wasn't that long ago and I don't think it was compromised. At least I hope not. It may have been a new plugin, but I'm fairly certain it was "Nowhere". I'll have to look into HTTPS Everywhere. Thanks for the recommendation.
- x1798DE 12y ago
  HTTPS Everywhere is a "soft enforcement" of HTTPS, with hand-curated regex that switches you to HTTPS if it's known by the EFF where the appropriate HTTPS server is. It's a wonderful, wonderful tool and I'd feel naked without it, but it "fails open" as it were - if something doesn't have https support, or the https support is buggy, it just shows you the http version. I believe HTTP Nowhere is similar to HTTPS Everywhere, but it "fails closed" - if there isn't an HTTPS version of a site, HTTP Nowhere just doesn't show you that site. I really hope we one day get to a world where it's feasible to have HTTP Nowhere on by default. There are a shocking number of sites which don't support HTTPS, probably because they are suffering some misapprehension about the overhead it adds. Amazon does a bizarre thing where they bounce you back and forth between HTTP and HTTPS depending on how much information about you that they feel a page reveals. It's quite an unstable situation for such a high value target. I wouldn't be surprised if there are a number of spearphishing and MITM attacks that take advantage of Amazon's cavalier attitude towards its customers' safety and privacy.
  - quesera 12y ago
    Good point. While I knew that HTTPS Everywhere would fall back to HTTP when necessary (and therefore "work" all the time), I never thought about the fact that the name implies otherwise. I guess I considered it more aspirational than declarative. "Revolution Now!", "HTTPS Everywhere!", etc. :) HTTP Nowhere looks like it takes a much harder line, which I hope will someday be practical for general usage.

by ejr 12y ago

quesera 12y ago

HTTPS Everywhere works great, all the time, for me. I've never heard of "HTTP Nowhere". If you were just misremembering the name, it might have been a long ago old version? Or maybe the borrowed computer was otherwise jacked.

ejr 12y ago
It wasn't that long ago and I don't think it was compromised. At least I hope not. It may have been a new plugin, but I'm fairly certain it was "Nowhere". I'll have to look into HTTPS Everywhere. Thanks for the recommendation.
x1798DE 12y ago
HTTPS Everywhere is a "soft enforcement" of HTTPS, with hand-curated regex that switches you to HTTPS if it's known by the EFF where the appropriate HTTPS server is. It's a wonderful, wonderful tool and I'd feel naked without it, but it "fails open" as it were - if something doesn't have https support, or the https support is buggy, it just shows you the http version. I believe HTTP Nowhere is similar to HTTPS Everywhere, but it "fails closed" - if there isn't an HTTPS version of a site, HTTP Nowhere just doesn't show you that site. I really hope we one day get to a world where it's feasible to have HTTP Nowhere on by default. There are a shocking number of sites which don't support HTTPS, probably because they are suffering some misapprehension about the overhead it adds. Amazon does a bizarre thing where they bounce you back and forth between HTTP and HTTPS depending on how much information about you that they feel a page reveals. It's quite an unstable situation for such a high value target. I wouldn't be surprised if there are a number of spearphishing and MITM attacks that take advantage of Amazon's cavalier attitude towards its customers' safety and privacy.
- quesera 12y ago
  Good point. While I knew that HTTPS Everywhere would fall back to HTTP when necessary (and therefore "work" all the time), I never thought about the fact that the name implies otherwise. I guess I considered it more aspirational than declarative. "Revolution Now!", "HTTPS Everywhere!", etc. :) HTTP Nowhere looks like it takes a much harder line, which I hope will someday be practical for general usage.