Firefox to force secure connections for selected domains

ronjor · Nov 2, 2012

Mozilla introduced a pre-loaded list of domains for Firefox that only can be connected to securely in order to help protect the privacy and security of users.

To force secure connections between the browser and a server, Mozilla uses HSTS (HTTP Strict Transport Security), a mechanism used by servers to indicate that the connecting browser must use a secure connection, wrote Mozilla's David Keeler in a blog post.
Click to expand...

https://www.infoworld.com/d/security/firefox-force-secure-connections-selected-domains-206292

TheWindBringeth · Nov 2, 2012

To make them handy to anyone interested...

Mozilla blog entry on this
https://blog.mozilla.org/security/2012/11/01/preloading-hsts/

Implement support for preloaded strict-transport-security (HSTS) sites
https://bugzilla.mozilla.org/show_bug.cgi?id=760307

Provide mechanism for sites to register as HSTS-always
https://bugzilla.mozilla.org/show_bug.cgi?id=643922

I haven't read all that carefully yet, but as long as the browser admin can disable this and HSTS across the board or on a site by site basis, and easily MITM SSL connections even for HSTS sites, it seems like an OK feature. It does appear that some certificate issues are being worked out:

https://bugzilla.mozilla.org/show_bug.cgi?id=800882

This problem is caused by the fact that gmail.com is considered HSTS by our preload list. One consequence of being HSTS is that certificate error exceptions cannot be created or used.

keeler just landed a patch on -beta that (temporarily) removes most Google properties, and many other sites, from our preloaded HSTS list. So, you will be able to add certificate exceptions again in the next beta update.

The long-term solution here is to have your system administrator (IT people) install the CA certificate used by your web scanner software/proxy into Firefox and mark it as being trusted for SSL. Then you will not have to add certificate exceptions for every site.
Click to expand...

Pinga · Nov 2, 2012

SSL stripping is a serious issue. A German study that just came out (SecureNet GmbH, november 2012) found that the prevalence of HSTS among 6.209 most visited German sites with HTTPS access is currently less than 0,2 %. Out of 424 German banking sites, only 79 had implemented HSTS.

http://www.securenet.de/fileadmin/papers/HTTP_Strict_Transport_Security_HSTS_Verbreitung.pdf

encus · Nov 14, 2012

ronjor said:

https://www.infoworld.com/d/security/firefox-force-secure-connections-selected-domains-206292
Click to expand...

Thanks for the info, Ronjor.

Now Facebook main login page is in https!
Any other sites?

Thank you.

Log in or Sign up

Firefox to force secure connections for selected domains

ronjor Global Moderator

TheWindBringeth Registered Member

Pinga Registered Member

encus Registered Member

Log in or Sign up

Firefox to force secure connections for selected domains

ronjor Global Moderator

TheWindBringeth Registered Member

Pinga Registered Member

encus Registered Member

Useful Searches