←back to thread

288 points fernandotakai | 1 comments | | HN request time: 0s | source
Show context
SCHiM ◴[] No.10040340[source]
I like the fact that a security issue is being tackled. What I absolutely hate is the fact that there are no ways to turn this option off.

Just like HSTS I can't turn this off and it leaves a bad taste in my mouth. Were originally I considered firebox to be a browser for power users, now I'm not too sure any more.

replies(1): >>10040409 #
acdha ◴[] No.10040409[source]
I'm mixed on the general issue – an option to turn it off is an option which is certain to be used to social engineer millions of people – but this is somewhat different from HSTS:

HSTS allows a site owner to set a security policy for access their own servers. There's no downside to using it, it doesn't affect anyone else, and in any case if you choose to use a service you're subject to their security policies. The fundamental choice is unaffected: use their service or go somewhere else.

In contrast, this is more controversial because it involves telling the user that they cannot do something they want to do. I think there's a strong argument that this is a pragmatic choice in the current security environment but it really does undercut user choice unless you reach the point of saying that the users who want to do this should know how to compile Mozilla.

replies(1): >>10041075 #
SCHiM ◴[] No.10041075[source]
I really, really disagree. If your data is on my computer I should have a say in what happens to it. If I want to tunnel your hsts connection through a proxy I should be able to do so.

You can't imagine how frustrated I was when I found out that I couldn't use my proxy any more, because some guy somewhere decided that it'd bee too hard to hard to add the following lines to firefox:

if (user_doesn't_want_hsts) { dont_do_hsts(); }

I can't even bend my head around how someone thought it was acceptable to totally take this option away from people. I understand that such an option should be hidden deep inside a config somewhere so as to prevent a normal user from compromising his/her own security. But please don't presume that you did everyone a service by taking this option away. I can't express how angry and frustrated I become when I even think about it.

As for your 'no downside', as I said, perhaps not for normal users. But I most definitively am not. And I probably need to jump though a lot of hoops to tear this "feature" out of my own firefox build.

replies(2): >>10041307 #>>10042099 #
1. nightpool ◴[] No.10042099[source]
You... really don't understand HSTS or how proxies work. Any actual secure proxy configuration would still work just fine with HSTS. Its only ones that specifically downgrade HTTPS connections to HTTP ones that break.