✨ Feature Suggestion | HTTPS Everywhere: recommend enabling EASE mode / CSP warning for Firefox webextensions #1292

New Issue

Open

opened 2019-09-10 21:27:26 +00:00 by Mikaela · 22 comments

Mikaela commented 2019-09-10 21:27:26 +00:00 (Migrated from github.com)

Copy Link

I happened to notice that I was accessing some sites, even ones that have HTTPS and even on Brave getting, over HTTP.

HTTPS Everywhere has opt-in mode Encrypt All Sites Eligible that seems useful that we could potentially recommend enabling?

• https://www.eff.org/deeplinks/2018/12/how-https-everywhere-keeps-protecting-users-increasingly-encrypted-web
• https://en.wikipedia.org/wiki/Downgrade_attack

I happened to notice that I was accessing some sites, even ones that have HTTPS and even on Brave getting, over HTTP. HTTPS Everywhere has opt-in mode *Encrypt All Sites Eligible* that seems useful that we could potentially recommend enabling? * https://www.eff.org/deeplinks/2018/12/how-https-everywhere-keeps-protecting-users-increasingly-encrypted-web * https://en.wikipedia.org/wiki/Downgrade_attack 

👍 1

nitrohorse commented 2019-09-11 05:17:04 +00:00 (Migrated from github.com)

Copy Link

Great idea! Also as reference, enabling EASE is a toggle:

Great idea! Also as reference, enabling EASE is a toggle: 

Thorin-Oakenpants commented 2019-09-11 06:23:52 +00:00 (Migrated from github.com)

Copy Link

This will use a CSP header injection that may or may not work: depending on your other extensions. Since web extensions, when two or more extensions use CSP header injection, only one will win: meaning the other extension(s) will fail to work as designed

some examples: some functions in : uBO, uMatrix, CanvasBlocker

• read: https://github.com/ghacksuserjs/ghacks-user.js/issues/664

This will use a CSP header injection that may or may not work: depending on your other extensions. Since web extensions, when two or more extensions use CSP header injection, only one will win: meaning the other extension(s) will fail to work as designed some examples: some functions in : uBO, uMatrix, CanvasBlocker - read: `https://github.com/ghacksuserjs/ghacks-user.js/issues/664`

👍 3

Mikaela commented 2019-09-11 08:10:38 +00:00 (Migrated from github.com)

Copy Link

Dawidpotocki mentioned that in team chat last night and I have two open questions about it:

• Should we have a warning about CSP header using extensions for our at least 7 extensions that can be in conflict?
• Does this issue also affect Chromium?

https://github.com/ghacksuserjs/ghacks-user.js/wiki/4.1-Extensions

Edit: see also https://github.com/EFForg/https-everywhere/issues/17735 via ghacks-user.js/664 ?
Edit2: related: https://github.com/EFForg/https-everywhere/issues/18194 but I don't think that one affects us.

Dawidpotocki mentioned that in team chat last night and I have two open questions about it: * Should we have a warning about CSP header using extensions for our at least 7 extensions that can be in conflict? * Does this issue also affect Chromium? https://github.com/ghacksuserjs/ghacks-user.js/wiki/4.1-Extensions Edit: see also https://github.com/EFForg/https-everywhere/issues/17735 via ghacks-user.js/664 ? Edit2: related: https://github.com/EFForg/https-everywhere/issues/18194 but I don't think that one affects us.

Thorin-Oakenpants commented 2019-09-11 08:21:38 +00:00 (Migrated from github.com)

Copy Link

Does this issue also affect Chromium

I don't think so: but I'm not an expert on chromium. See https://bugzilla.mozilla.org/show_bug.cgi?id=1462989#c20

gorhill:

... which actually explains why it works with Chromium

> Does this issue also affect Chromium I don't think so: but I'm not an expert on chromium. See https://bugzilla.mozilla.org/show_bug.cgi?id=1462989#c20 gorhill: > ... which actually explains why it works with Chromium

👍 1

blacklight447 commented 2019-09-17 10:01:13 +00:00 (Migrated from github.com)

Copy Link

maybe we can add this with a trade off warning? I can see quite a few people not using umatrix, and i think most of what canvas blocker does can also be done by turning on resist fingerprinting.

maybe we can add this with a trade off warning? I can see quite a few people not using umatrix, and i think most of what canvas blocker does can also be done by turning on resist fingerprinting.

👍 1 👎 1 😕 1

Zenithium commented 2020-03-08 12:18:00 +00:00 (Migrated from github.com)

Copy Link

maybe we can add this with a trade off warning? I can see quite a few people not using umatrix, and i think most of what canvas blocker does can also be done by turning on resist fingerprinting.

Perhaps you could make an argument for uMatrix and Canvas Blocker, but not uBO. Most people are using uBO and uBO should have priority with CSP. I do not want to encourage undefined behavior with seeing which add-on wins the race. This is especially true in the case with NoScript since it could compromise user security.

> maybe we can add this with a trade off warning? I can see quite a few people not using umatrix, and i think most of what canvas blocker does can also be done by turning on resist fingerprinting. Perhaps you could make an argument for uMatrix and Canvas Blocker, but not uBO. Most people are using uBO and [uBO should have priority with CSP](https://github.com/ghacksuserjs/ghacks-user.js/issues/664#issuecomment-472596147). I do not want to encourage undefined behavior with seeing which add-on wins the race. This is especially true in the case with NoScript since it could [compromise user security](https://github.com/EFForg/https-everywhere/issues/17735#issuecomment-500173154).

5a384507-18ce-417c-bb55-d4dfcc8883fe commented 2020-03-08 13:51:04 +00:00 (Migrated from github.com)

Copy Link

How do you know which one wins then? I have uMatrix, uBlock O and HTTPS E, with EASE mode activated and uM on hard mode, if there's going to be a trade off warning then it should be explained a bit more on that, not simply, "One might win over the other, bye".

How do you know which one wins then? I have uMatrix, uBlock O and HTTPS E, with EASE mode activated and uM on hard mode, if there's going to be a trade off warning then it should be explained a bit more on that, not simply, "One might win over the other, bye".

Thorin-Oakenpants commented 2020-03-09 01:09:57 +00:00 (Migrated from github.com)

Copy Link

How do you know which one wins then? .... if there's going to be a trade off warning then it should be explained a bit more on that, not simply, "One might win over the other, bye".

There is no such simple answer as to which one wins. It depends on which order they were loaded by Firefox, and if an extension is updated, it is reloaded, potentially changing the order. Not to mention if a user toggles their extension on/off. Not everyone will get the same results, nor will their results always be consistent. To add to this mess, NoScript should win, because it uses a never ending loop of checking and retrying to make sure it does (just be glad no one else did this)

Feel free to write up a simple explanation for first time users

> How do you know which one wins then? .... if there's going to be a trade off warning then it should be explained a bit more on that, not simply, "One might win over the other, bye". There is no such simple answer as to which one wins. It depends on which order they were loaded by Firefox, and if an extension is updated, it is reloaded, potentially changing the order. Not to mention if a user toggles their extension on/off. Not everyone will get the same results, nor will their results always be consistent. To add to this mess, NoScript **should** win, because it uses a never ending loop of checking and retrying to make sure it does (just be glad no one else did this) Feel free to write up a simple explanation for first time users

😕 1

dngray commented 2020-05-05 15:43:38 +00:00 (Migrated from github.com)

Copy Link

@Thorin-Oakenpants I have been thinking we might stop listing HTTPS-Everywhere or extensions like this and just instruct people to turn on Firefox 76 gets optional HTTPS-only mode (ghacks).

What are your thoughts on this? It would allow us to also easily close https://github.com/privacytoolsIO/privacytools.io/issues/1326

@Thorin-Oakenpants I have been thinking we might stop listing HTTPS-Everywhere or extensions like this and just instruct people to turn on [Firefox 76 gets optional HTTPS-only mode (ghacks)](https://www.ghacks.net/2020/03/24/firefox-76-gets-optional-https-only-mode/). What are your thoughts on this? It would allow us to also easily close https://github.com/privacytoolsIO/privacytools.io/issues/1326

👍 2

Thorin-Oakenpants commented 2020-05-05 18:42:03 +00:00 (Migrated from github.com)

Copy Link

No, https-only-mode is not ready. Maybe it could be ready for ESR78

edit: we were discussing it at https://github.com/ghacksuserjs/ghacks-user.js/issues/932 if you want some more details

No, https-only-mode is not ready. Maybe it could be ready for ESR78 edit: we were discussing it at `https://github.com/ghacksuserjs/ghacks-user.js/issues/932` if you want some more details

dngray commented 2020-05-06 06:27:26 +00:00 (Migrated from github.com)

Copy Link

No, https-only-mode is not ready. Maybe it could be ready for ESR78

ty, we will keep that in mind.

> No, https-only-mode is not ready. Maybe it could be ready for ESR78 ty, we will keep that in mind.

dngray commented 2020-10-07 03:57:26 +00:00 (Migrated from github.com)

Copy Link

No, https-only-mode is not ready. Maybe it could be ready for ESR78

Now that 78 is out have you any new thoughts on this?

> No, https-only-mode is not ready. Maybe it could be ready for ESR78 Now that 78 is out have you any new thoughts on this?

Thorin-Oakenpants commented 2020-10-07 04:39:44 +00:00 (Migrated from github.com)

Copy Link

it's nowhere near being ready: still experimental. They only just landed the ability today to use the UI to allow site exceptions (permanent or session only) see https://github.com/arkenfox/user.js/issues/1003#issuecomment-704413469

And then I'm not sure what happens with insecure downloads on secure sites (if you allow an exception and continue on) - I think downloads are treated as a separate item since they're user initiated - but IDK for sure: not deep dived it all (yet)

Also, read this -> https://github.com/arkenfox/user.js/issues/1032#issuecomment-704479070 <-- that's my story/experience - i.e HTTPS-E is fast becoming redundant (but note that I don't allow mixed content: active and* passive)

it's nowhere near being ready: still experimental. They only just landed the ability today to use the UI to allow site exceptions (permanent or session only) see https://github.com/arkenfox/user.js/issues/1003#issuecomment-704413469 And then I'm not sure what happens with insecure downloads on secure sites (if you allow an exception and continue on) - I *think* downloads are treated as a separate item since they're user initiated - but IDK for sure: not deep dived it all (yet) Also, read this -> https://github.com/arkenfox/user.js/issues/1032#issuecomment-704479070 <-- that's my story/experience - i.e HTTPS-E is fast becoming redundant (but note that I don't allow mixed content: active *and** passive)

dngray commented 2020-10-07 05:00:51 +00:00 (Migrated from github.com)

Copy Link

They only just landed the ability today to use the UI to allow site exceptions (permanent or session only) see arkenfox/user.js#1003 (comment)

That was a concern is that if someone wanted to temporarily undo this setting, editing about:config is fiddly and annoying.

Maybe for the time being we should continue to recommend https-everywhere (fortunately functional on Fenix builds).

> They only just landed the ability today to use the UI to allow site exceptions (permanent or session only) see [arkenfox/user.js#1003 (comment)](https://github.com/arkenfox/user.js/issues/1003#issuecomment-704413469) That was a concern is that if someone wanted to temporarily undo this setting, editing about:config is fiddly and annoying. Maybe for the time being we should continue to recommend https-everywhere (fortunately functional on Fenix builds).

lynn-stephenson commented 2020-10-07 05:44:27 +00:00 (Migrated from github.com)

Copy Link

I was conducting research on HTTPS Only today, so: First off there is no supplied UI for users, at least for the latest stable FF. Recommending HTTPS Everywhere is the best option until stable Firefox has a built in UI for HTTPS Only.

When HTTPS Only mode is enabled, only HTTPS connections are made on mixed content websites (from the testing I conducted via badssl.com), and non-HTTPS capable connections are simply dropped after attempting several times to connect via HTTPS. No data is sent via POST until the connection is secure, even after acknowledging the warning displayed to the user.

I have not tested all cases (e.g: downloads), but it appears that HTTPS Only works well, with the exception of providing UIs. I could only recommend it as defense in depth for advanced users.

---

With all of that said, I don't believe you should remove HTTPS Everywhere, especially if adversaries willing to serve you malicious payloads via intercepted non-secured HTTP traffic are part of your threat model.

I was conducting research on HTTPS Only today, so: First off there is no supplied UI for users, at least for the latest stable FF. Recommending HTTPS Everywhere is the best option until stable Firefox has a built in UI for HTTPS Only. When HTTPS Only mode is enabled, *only* HTTPS connections are made on mixed content websites (from the testing I conducted via [badssl.com](https://badssl.com/)), and non-HTTPS capable connections are simply dropped after attempting several times to connect via HTTPS. No data is sent via POST until the connection is secure, even after acknowledging the warning displayed to the user. I have not tested all cases (e.g: downloads), but it appears that HTTPS Only works well, with the exception of providing UIs. I could only recommend it as *defense in depth* for advanced users. --- With all of that said, I don't believe you should remove HTTPS Everywhere, especially if adversaries willing to serve you malicious payloads via intercepted non-secured HTTP traffic are part of your threat model.

👍 1

Thorin-Oakenpants commented 2020-10-07 06:02:18 +00:00 (Migrated from github.com)

Copy Link

With all of that said, I don't believe you should remove HTTPS Everywhere, especially if adversaries willing to serve you malicious payloads via intercepted non-secured HTTP traffic are part of your threat model

playing devils advocate: unless using EASE mode, HTTPS-E doesn't preclude that

That said, it certainly can't hurt, and the internet has a long way to go, and a very long tail. So yeah, keep it listed. But I think once HTTPS-only mode is done, that it's a more efficient and effective solution - but you need to think of ESR users, so at the earliest, you can't do anything for a year ESR78 is EOL... next ESR is ESR91 and the old one lives for three releases in tandem (4 week cycles) .. so when FF94 lands in about Oct 2021, you can revisit it

!remind me in 1 year :)

> With all of that said, I don't believe you should remove HTTPS Everywhere, especially if adversaries willing to serve you malicious payloads via intercepted non-secured HTTP traffic are part of your threat model playing devils advocate: unless using EASE mode, HTTPS-E doesn't preclude that That said, it certainly can't hurt, and the internet has a long way to go, and a very long tail. So yeah, keep it listed. But I think once HTTPS-only mode is done, that it's a more efficient and effective solution - but you need to think of ESR users, so at the earliest, you can't do anything for a year ESR78 is EOL... next ESR is ESR91 and the old one lives for three releases in tandem (4 week cycles) .. so when FF94 lands in about Oct 2021, you can revisit it !remind me in 1 year :)

👍 3

dngray commented 2020-11-18 03:37:44 +00:00 (Migrated from github.com)

Copy Link

@Thorin-Oakenpants

Looks like this feature is now in stable Firefox with UI elements.

https://blog.mozilla.org/security/2020/11/17/firefox-83-introduces-https-only-mode/

I think we could safely assume that it works stably now? We could put a note next to HTTPS-Everywhere that it is only necessary if you have an ESR version of Firefox, and link to that blog article as it is now a part of Firefox.

@Thorin-Oakenpants Looks like this feature is now in stable Firefox with UI elements. https://blog.mozilla.org/security/2020/11/17/firefox-83-introduces-https-only-mode/ I think we could safely assume that it works stably now? We could put a note next to HTTPS-Everywhere that it is only necessary if you have an ESR version of Firefox, and link to that blog article as it is now a part of Firefox.

Thorin-Oakenpants commented 2020-11-18 04:59:39 +00:00 (Migrated from github.com)

Copy Link

Or you could wait a month and see what happens with the outstanding bugs now it has a UI in stable, and more people will use it. Generally, it should be pretty good to go, but why put some of your readers through hell if say for example, latestsocialmedia craze broke, or lots of times they hit the www issue.. etc

I see on reddit, lots of people were pointing out that they didn't know how to make an exception permanent - so it needs work IMO

Or you could wait a month and see what happens with the [outstanding bugs](https://github.com/arkenfox/user.js/issues/1047) now it has a UI in stable, and more people will use it. Generally, it should be pretty good to go, but why put some of your readers through hell if say for example, latestsocialmedia craze broke, or lots of times they hit the `www` issue.. etc I see on reddit, lots of people were pointing out that they didn't know how to make an exception permanent - so it needs work IMO

lynn-stephenson commented 2020-11-18 06:40:46 +00:00 (Migrated from github.com)

Copy Link

Agreed. It was just released to the public, and should be given some time before being recommended over HTTPS Everywhere.

Agreed. It was just released to the public, and should be given some time before being recommended over HTTPS Everywhere.

Thorin-Oakenpants commented 2020-11-18 06:54:34 +00:00 (Migrated from github.com)

Copy Link

^^ these two

• 1662710 add preferences UI to manage exceptions
• 1676227 consider some kind of clue that an upgrade has happened in the UI

^^ these two * [1662710](https://bugzilla.mozilla.org/1662710) add preferences UI to manage exceptions * [1676227](https://bugzilla.mozilla.org/1676227) consider some kind of clue that an upgrade has happened in the UI

gary-host-laptop commented 2020-11-18 14:07:50 +00:00 (Migrated from github.com)

Copy Link

Also I don't see the option to do this on mobile, so I'm guessing this is desktop only for now so HTTPS Everywhere still should be listed for such platform for now.

Also I don't see the option to do this on mobile, so I'm guessing this is desktop only for now so HTTPS Everywhere still should be listed for such platform for now.

👍 1

Mikaela commented 2020-11-22 18:16:30 +00:00 (Migrated from github.com)

Copy Link

It looks like Arkenfox has enabled it. 91cbc1e09a

It looks like Arkenfox has enabled it. https://github.com/arkenfox/user.js/commit/91cbc1e09a15c2fb5ad151529712f4326a6b7308

This repo is archived. You cannot comment on issues.

No Branch/Tag Specified

Branches Tags

master

dependabot/bundler/nokogiri-1.13.6

dependabot/bundler/addressable-2.8.0

freddy-m-patch-3

pr-add_RemoveMyPhone_sponsor

pr-browser_cleanup_1257_1328_1430

freddy-m-patch-2

freddy-m-patch-1

pr-vpn_hated_one_video

cdn

update-nitrohorse-image

promote-metager-to-card

hardware

pr-add_azirevpn

pr-add_mailfence

shop

1673

pr/1658

i18n-simple

sponsorship-edits-nov2019

i18n

ipfs

blacklight447-ptio-patch-3

blog

remove-windows-icons

pr/1147

i18n-testing

add-beautify

Labels

Clear labels   

🔍🤖 Search Engines

  

approved

approved, waiting for a PR

  

dependencies

Pull requests that update a dependency file

  

duplicate

  

feedback wanted

  

high priority

  

I2P

The Invisible Internet Project (I2P)

  

iOS

  

low priority

  

OS

Operating Systems

  

Self-contained networks

  

Social media

  

stale

A label for stalebot if it gets added

  

streaming

Anything related to media streaming.

  

todo

  

Tor

Anything covering the Tor network

  

WIP

active work in progress, do not merge or PR (yet)!

  

wontfix

Issues or bugs that will not be fixed and/or do not have significant impact on the project.

  

XMPP

Extensible Messaging and Presence Protocol

  

[m]

Matrix protocol

  

₿ cryptocurrency

  

ℹ️ help wanted

  

↔️ file sharing

  

⚙️ web extensions

Browser Extension related issues

  

✨ enhancement

  

❌ software removal

  

💬 discussion

  

🤖 Android

  

🐛 bug

  

💢 conflicting

  

📝 correction

Correction of content on the website

  

🆘 critical

  

📧 email

  

🔒 file encryption

  

📁 file storage

  

🦊 Firefox

Firefox & forks, about:config etc.

  

💻 hardware

  

🌐 hosting

  

🏠 housekeeping

Anything primarily related to site cleanup.

  

🔐 password managers

  

🧰 productivity tools

  

🔎 research required

  

🌐 Social News Aggregators

  

🆕 software suggestion

  

👥 team chat

  

🔒 VPN

Virtual Private Network

  

🌐 website issue

*Technical* issues with the website.

  

🚫 Windows

  

👁️ browsers

  

🖊️ digital notebooks

  

🗄️ DNS

Domain Name System

  

🗨️ instant messaging (im)

  

🇦🇶 translations

Anything covering a translated version of the site

No Label

🔍🤖 Search Engines

approved

dependencies

duplicate

feedback wanted

high priority

I2P

iOS

low priority

OS

Self-contained networks

Social media

stale

streaming

todo

Tor

WIP

wontfix

XMPP

[m]

₿ cryptocurrency

ℹ️ help wanted

↔️ file sharing

⚙️ web extensions

✨ enhancement

❌ software removal

💬 discussion

🤖 Android

🐛 bug

💢 conflicting

📝 correction

🆘 critical

📧 email

🔒 file encryption

📁 file storage

🦊 Firefox

💻 hardware

🌐 hosting

🏠 housekeeping

🔐 password managers

🧰 productivity tools

🔎 research required

🌐 Social News Aggregators

🆕 software suggestion

👥 team chat

🔒 VPN

🌐 website issue

🚫 Windows

👁️ browsers

🖊️ digital notebooks

🗄️ DNS

🗨️ instant messaging (im)

🇦🇶 translations

Milestone

Clear milestone

No items

No Milestone

Assignees

Clear assignees

No Assignees

1 Participants

Due Date

The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: privacyguides/privacytools.io#1292

No description provided.