Hacker News Reader

Comment by MattBearman | Hacker News Reader

I suspect the problem is that http is still the default. If you type a url without a protocol into a browser, it goes to http://[url]

So unless the site in question is set up to redirect http requests to https, most links will be http.

I wonder if browsers should always try https first if no protocol is specified? But then as has been pointed out before on here, there's no guarantee that the http and https versions of the same url will have the same content.

View on HN

They could also help drive HTTPS adoption by being more alarmist about unencrypted traffic (e.g. a warning triangle instead of a globe icon).

Good point. I borrowed a computer that had "HTTP Nowhere" installed on Firefox, but that seemed to break a lot of things to the point I had to turn it off. That may explain why browsers still default to http.

HTTPS Everywhere works great, all the time, for me. I've never heard of "HTTP Nowhere". If you were just misremembering the name, it might have been a long ago old version? Or maybe the borrowed computer was otherwise jacked.

It wasn't that long ago and I don't think it was compromised. At least I hope not. It may have been a new plugin, but I'm fairly certain it was "Nowhere".

I'll have to look into HTTPS Everywhere. Thanks for the recommendation.

HTTPS Everywhere is a "soft enforcement" of HTTPS, with hand-curated regex that switches you to HTTPS if it's known by the EFF where the appropriate HTTPS server is. It's a wonderful, wonderful tool and I'd feel naked without it, but it "fails open" as it were - if something doesn't have https support, or the https support is buggy, it just shows you the http version.

I believe HTTP Nowhere is similar to HTTPS Everywhere, but it "fails closed" - if there isn't an HTTPS version of a site, HTTP Nowhere just doesn't show you that site.

I really hope we one day get to a world where it's feasible to have HTTP Nowhere on by default. There are a shocking number of sites which don't support HTTPS, probably because they are suffering some misapprehension about the overhead it adds. Amazon does a bizarre thing where they bounce you back and forth between HTTP and HTTPS depending on how much information about you that they feel a page reveals. It's quite an unstable situation for such a high value target. I wouldn't be surprised if there are a number of spearphishing and MITM attacks that take advantage of Amazon's cavalier attitude towards its customers' safety and privacy.

Good point. While I knew that HTTPS Everywhere would fall back to HTTP when necessary (and therefore "work" all the time), I never thought about the fact that the name implies otherwise.

I guess I considered it more aspirational than declarative. "Revolution Now!", "HTTPS Everywhere!", etc. :)

HTTP Nowhere looks like it takes a much harder line, which I hope will someday be practical for general usage.

Defaulting to HTTPS would be great, except for the fact that different apps can run on different ports. Port 80 != port 443.

I don't see why this is relevant. You can proxy it to another port?

You can proxy to different ports. The point I was making is that HTTP and HTTPS do not (and cannot) run on the same port, due to the differences in protocol (HTTPS wants to SSL Handshake, HTTP doesn't know what that is). When talking about different ports on the same server, it is not guaranteed (and often not expected) that the same website/application will be running on it.

Reply on news.ycombinator.com