Mozilla - Deprecating Non-Secure HTTP

I'm not convinced by the way it's enforced upon and the comments on that Mozilla page are well worth reading,some lift proper and well placed objections and concerns

as Lestat wrote on May 1, 2015 at 7:30 am:

What about hobby projects which do only offer static HTML pages? This is a whole discrimination of small webprojects which either see no reason moving on towards HTTPS or have neither time or the necessary knowledge.

This probably won't work out too well for old websites that aren't maintained anymore.

I don't understand mozilla: on one hand, they decide to include anti-privacy and annoying features like adds included inside the browser and third party cookies enabled by default and on the other hand they are dropping http in favor of the more secure https.

If you see the scripts Mr. Rodrigez uses to build abrowser you will appreciate how large the configuration modifier is to make the browser more secure; let me share some examples:

// Disable third party cookies
pref("network.cookie.cookieBehavior", 1);
// Privacy & Freedom Issues
// https://webdevelopmentaid.wordpress.com/2013/10/21/customize-privacy-settings-in-mozilla-firefox-part-1-aboutconfig/
// https://panopticlick.eff.org
// https://wiki.mozilla.org/Fingerprinting
pref("privacy.donottrackheader.enabled", true);
pref("privacy.donottrackheader.value", 1);
pref("dom.ipc.plugins.flash.subprocess.crashreporter.enabled", false);
pref("browser.safebrowsing.enabled", false);
pref("browser.safebrowsing.malware.enabled", false);
pref("services.sync.privacyURL", "http://trisquel.info/en/legal");
pref("social.enabled", false);
pref("social.remote-install.enabled", false);
pref("datareporting.healthreport.uploadEnabled", false);
pref("social.toast-notifications.enabled", false);
pref("datareporting.healthreport.uploadEnabled", false);
pref("datareporting.healthreport.service.enabled", false);
pref("browser.slowStartup.notificationDisabled", true);
pref("network.http.sendRefererHeader", 2);
//Disable heartbeat
pref("browser.selfsupport.url", "");

// Disable plugin installer
pref("plugins.hide_infobar_for_missing_plugin", true);
pref("plugins.hide_infobar_for_outdated_plugin", true);
pref("plugins.notifyMissingFlash", false);

And that is just a sample.

I don't know what is happening in Mozilla but doesn't seem good.

In the hands of Big Co interests?

as rtechie wrote :

As someone who does a lot of work with PKI, I think this is an extremely bad idea.

Making HTTPS mandatory will seriously degrade the security of existing web sites.

Right now, the main problems with SSL/TLS have to do with bad actions by root Certificate Authorities (like China’s CA) issuing inappropriate or questionable certificates.

You’re assuming that site operators, and more importantly users, are going to use HTTPS intelligently and appropriately and that’s a bad assumption.

Forcing every single site to use HTTPS means that unless that site has a root CA cert, users will get a browser error. And we’ve “trained” users to avoid sites with browser errors. This will create a “gold rush” with the root CAs as lots of smaller sites start requesting certs. This will inevitably lead to more bad certs being issued.

And there will be a LOT more questionable certs issued.

Because you intend to block features behind HTTPS, you’re making it impossible to TEST using HTTP, so every single internal, QA, or test site needs a cert. Sure, they can use self-signed, but users will get a browser error. So now either that organization has to run their own CA or get more certs from the root CAs, which is a lot easier. That’s going to be a flood of cert requests on the CAs.

I really need to stress what a problem it is that you’re requiring certs for all internal web sites.

And what about intranet sites in general? Have you guys developed a better method, of any kind, for distributing enterprise root certs around? Right now, I have to manually install them on every PC. Now you’re saying I have to do that no matter what.

The short version is that the core problem with HTTPS right now is that it’s too popular. Making HTTPS mandatory will further degrade it’s utility and put serious and important uses of HTTPS, like financial transactions, in danger.

as pepole tend not to visit your site when a scary:
"this connection is not trusted message" comes up

dose anyone know of a way to register your https certificate gratis or cheap?
the lowest i found was £40 a year :(

I think this is a great idea. Note that Mozilla and EFF are starting Let's Encrypt, so it will be much easier for people to move to HTTPS.