Closed Bug 1684890 Opened 5 years ago Closed 5 years ago

Treat non-https destinations as insecure by default.

Categories

(Firefox :: Security, enhancement)

Product:
Firefox
Component:
Security
Type:
enhancement

Tracking

()

Status:
RESOLVED INVALID

People

(Reporter: u677327, Unassigned)

Details

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0

Steps to reproduce:

Visit a website without TLS.

Actual results:

The site loads and the user is unaware that there is a security risk.

Expected results:

Most users are unaware of the difference between http/https and it’s a nuisance for skilled users to check every link destination before clicking them.

Unencrypted connections are susceptible to malicious attacks be low skilled attackers and state attacks like the NSA's QUANTUMINSERT.

A warning should be displayed similar to a certificate exception that requires the user to click through to the insecure page for all non-https destinations.

Component: Security: PSM → Security
Product: Core → Firefox

dom.security.https_only_mode should be enabled by default.

Summary: Treat non-https destinations as insecure. → Treat non-https destinations as insecure by default.

I don't think anyone here thinks that HTTPS-Only Mode shouldn't be on by default eventually, but it doesn't really make sense to file a bug asking for that. It is a product decision by the team working on the feature and I can assure you that they'll continue trying to push it forward as much as possible without breaking the web too much. We'll get there. In the meantime, I don't think this bug is needed.

Status: UNCONFIRMED → RESOLVED
Closed: 5 years ago
Resolution: --- → INVALID
You need to log in before you can comment on or make changes to this bug.