SoylentNews is people
SoylentNews
from the it's-the-end-of-the-web-as-we-know-it-and-i-feel-fine dept.
Phoronix reports the Mozilla Security Engineering team is planning to make their browser useless for browsing much of the World Wide Web, by deprecating insecure HTTP.
Richard Barnes of Mozilla writes:
In order to encourage web developers to move from HTTP to HTTPS, I would like to propose establishing a deprecation plan for HTTP without security. Broadly speaking, this plan would entail limiting new features to secure contexts, followed by gradually removing legacy features from insecure contexts. Having an overall program for HTTP deprecation makes a clear statement to the web community that the time for plaintext is over -- it tells the world that the new web uses HTTPS, so if you want to use new things, you need to provide security.
See also this document outlining the initial plans.
(Score: 1, Flamebait) by Ethanol-fueled on Wednesday April 15 2015, @05:32AM
Firefox is shitty enough to use as it is.
> Go to legit website
> OMG! You're at Starbucks! INVALID CERT
> But I just wanna check my Gmail
> Wanna click through 3 reminder pages to allow a SECURITY EXCEPTION so you can BROWSE GMAIL from STARBUCKS?
> Sure.
> Too bad. WE WON'T ALLOW YOU to make a SECURITY EXCEPTION! SECURITY! YOU'RE TOO STUPID TO USE YOUR OWN COMPUTER. BE AFRAID!
> Aw, shucks.
> IT'S FOR YOUR OWN GOOD, IDIOT. I'M THE GUY WHO CODED THIS 'FEATURE' AND NEVER GOT LAID IN COLLEGE!
> *Groan.*
(Score: 5, Informative) by Anonymous Coward on Wednesday April 15 2015, @08:13AM
In that situation, you should not accept the certificates; that's the one situation where the warning is absolutely legitimate!
Either you connected not to Starbucks' access point, but to a malicious access point that masquerades as Starbucks' access point, or if this really happens with legitimate Starbucks access points, then Starbucks itself is doing something bad. In both cases you should not trust the certificate. Instead, use a VPN to somewhere that doesn't mess with your certificates.
(Score: 0) by Anonymous Coward on Wednesday April 15 2015, @10:52PM
The problem here is that with hotspots like Starbucks, they are MITMing you, but only when you first connect. When you connect in places like Starbucks, McDonald's, etc., they hijack the very first webpage that you browse to in order to show you the terms of service for their network. Once you click accept, they leave you alone. This generates a security fault because FX is expecting the proper certificate for gmail, facebook, whatever https site you first go to, and doesn't receive it because you're not on the internet yet (as it should).
It is correct to use a VPN after you first connect, but you have to go through that bullshit first.
(Score: 0) by Anonymous Coward on Friday April 17 2015, @10:43PM
And this will be broken with modern browsers soon. So Starbucks will have to replace their WiFi or turn off this feature entirely when this happens. They will get too many complaints about it being broken, and eventually, very few devices will be able to use it.
MITM hotspots are dead.
(Score: 4, Touché) by darkfeline on Wednesday April 15 2015, @02:45PM
It's is for your own good, idiot. Invalid cert means someone is MITMing your connection to Gmail, meaning they can steal your Gmail password, meaning that they have full access to every single site you have registered using that email account, which may mean that your bank account would now be going for $10 on the black market. It's a premium price because its owner is stupid and less likely to notice someone draining it dry.
Join the SDF Public Access UNIX System today!
(Score: 0) by Anonymous Coward on Thursday April 16 2015, @05:18PM
And the providers of Free WiFi do MITM you if you want the free WiFi. But they aren't stealing your password.
But we knew that already and were willing to accept the risk. But the program won't let us.
And we knew all that already.
IDIOT.
When someone acts for "my own good," then wouldn't it be lovely if they actually checked with me to make sure their definition and mine coexist? And, if I want to use a burner email account, let me?
(Score: 2) by darkfeline on Thursday April 16 2015, @09:07PM
>And the providers of Free WiFi do MITM you if you want the free WiFi. But they aren't stealing your password.
Are you sure that the providers of your free WiFi really aren't stealing your password? Are you even sure that it is the WiFi providers that are MITMing you and not one of your fellow cafe-goers?
Join the SDF Public Access UNIX System today!