SoylentNews is people
SoylentNews
from the it's-the-end-of-the-web-as-we-know-it-and-i-feel-fine dept.
Phoronix reports the Mozilla Security Engineering team is planning to make their browser useless for browsing much of the World Wide Web, by deprecating insecure HTTP.
Richard Barnes of Mozilla writes:
In order to encourage web developers to move from HTTP to HTTPS, I would like to propose establishing a deprecation plan for HTTP without security. Broadly speaking, this plan would entail limiting new features to secure contexts, followed by gradually removing legacy features from insecure contexts. Having an overall program for HTTP deprecation makes a clear statement to the web community that the time for plaintext is over -- it tells the world that the new web uses HTTPS, so if you want to use new things, you need to provide security.
See also this document outlining the initial plans.
(Score: 5, Informative) by Anonymous Coward on Wednesday April 15 2015, @08:13AM
In that situation, you should not accept the certificates; that's the one situation where the warning is absolutely legitimate!
Either you connected not to Starbucks' access point, but to a malicious access point that masquerades as Starbucks' access point, or if this really happens with legitimate Starbucks access points, then Starbucks itself is doing something bad. In both cases you should not trust the certificate. Instead, use a VPN to somewhere that doesn't mess with your certificates.
(Score: 0) by Anonymous Coward on Wednesday April 15 2015, @10:52PM
The problem here is that with hotspots like Starbucks, they are MITMing you, but only when you first connect. When you connect in places like Starbucks, McDonald's, etc., they hijack the very first webpage that you browse to in order to show you the terms of service for their network. Once you click accept, they leave you alone. This generates a security fault because FX is expecting the proper certificate for gmail, facebook, whatever https site you first go to, and doesn't receive it because you're not on the internet yet (as it should).
It is correct to use a VPN after you first connect, but you have to go through that bullshit first.
(Score: 0) by Anonymous Coward on Friday April 17 2015, @10:43PM
And this will be broken with modern browsers soon. So Starbucks will have to replace their WiFi or turn off this feature entirely when this happens. They will get too many complaints about it being broken, and eventually, very few devices will be able to use it.
MITM hotspots are dead.