Hacker News Reader

Comment by abraxaz | Hacker News Reader

Great to see this built into firefox, I have been using HTTPS Everywhere https://www.eff.org/https-everywhere to achieve similar results, it won't warn you if it is not https (i think) but it will try and upgrade to https if it can. It is available for chrome and firefox.

What particularly annoyed me was using http to sites which supported https.

View on HN

I remember years ago when Facebook wasn’t using https and a bunch of articles came out with how to access someone’s account if you’re both on unencrypted public wifi. Since then I’ve been a fan of https everywhere

IIRC this was around the time when someone created Firesheep [0] which made it really easy to steal unencrypted session cookies via packet sniffing, which sparked all those articles you are talking about.

[0]: https://en.wikipedia.org/wiki/Firesheep

For me at least it warns me very blatantly and I have to asked to go to an insecure site if it's HTTP only. Perhaps we don't have the same configuration.

That's not enabled by default, you first have to flip the "Encrypt All Sites Eligible" switch.

IIRC HTTPS Everywhere works by having a whitelist of domains that are also accessible over https, and switches to https for those.

So if a site isn't in the whitelist, it won't modify the request in any way.

HTTPS Everywhere will attempt to connect to a site using SSL, and if that times out will pop out an error message and allow you to load the site over HTTP temporarily. At least that's how it works on Firefox + latest version of the extension.

Only if you have the "encrypt all elgible sites" option enabled, which is disabled by default.

HTTPS Everywhere already supports a HTTPS-only mode called EASE, it is opt-in though.

As others pointed out, you can set it up to always upgrade to HTTPS and warn you when it's not supported. But that's not gonna work all the time: some websites will have self-signed certificates (which is better that nothing I guess), some will return 403 or 404 (for HTTPS only), some will just not load after trying for half a minute.

The Brave browser has this feature built-in, by the way (Settings > Shields > Upgrade connections to HTTPS [X])

Reply on news.ycombinator.com