Advice Request HTTPS Everywhere, should be always on?

[camo7782]

First, installing on Firefox it is being blocked by Firefox and need a confirmation.

After installing I see it has two checks, I'm wondering what is the first check doing when the second is disabled, anyone that knows?

 

[Captain Awesome]

Yes.

 

[HarborFront]

IMO, it's not necessary to have HTTPS Everywhere extension. Reasons being

1) Most of the sites nowadays are HTTPS although some sites still are HTTP
2) The website may contain Mixed content (i.e. the content on the website is not 100% secure or unencrypted) resulting in the insecure content (e.g. images) portion subject to abuse. HTTPS Everywhere cannot force these sites to be HTTPS
3) The green padlock icon is no longer an indication that the website is safe for it can be phished. A study showed that 49% of the phishing sites carry the green padlock icon. Read below

HTTPS Phishing: 49% of Phishing Websites now sport the green padlock

HTTPS phishing has never been more prevalent, half of all websites now have the green padlock icon. We need to have a different discussion about HTTPS.

www.thesslstore.com

 

[Moonhorse]

It gives you feeling like youre being protected, but otherwise its not that useful, in worst cases it just breaks website

Chrome users may aswell set chrome flag to ''mark non secure websites as dangerous''

 

[Nightwalker]

HTTPS isnt about phishing protection (it never was), it is all about session hijacking and privacy protection.

Combined with a Secure DNS (DNSSEC support/Simple DNSCrypt), HTTPS Everywhere offers a reasonable secure environment, specially if your browser supports Encrypted SNI.

Is it necessary to have this extension? No, but it is still nice to have it on all the time to avoid HSTS attacks and ISP code injections.

Reference:

Code injection: A new low for ISPs

Beyond underhanded, Comcast and other carriers are inserting their own ads and notifications into their customers’ data streams

www.infoworld.com

How HTTPS Everywhere Keeps Protecting Users On An Increasingly Encrypted Web

Way back in 2010, we launched our popular browser extension HTTPS Everywhere as part of our effort to encrypt the web. At the time, the need for HTTPS Everywhere to protect browsing sessions was as obvious as the threats were ever-present. The threats may not be as clear now, but HTTPS...

www.eff.org

 

[Threadripper]

HTTPS Everywhere is essential, and that second option you were asking about blocks HTTP connections.

 

[Threadripper]

It gives you feeling like youre being protected, but otherwise its not that useful, in worst cases it just breaks website

Chrome users may aswell set chrome flag to ''mark non secure websites as dangerous''

That's okay for the main website, but what about every connection a website makes to other domains?

 

[SeriousHoax]

You don't need to turn that option on. That would break HTTP sites. Don't change anything. Just install & forget.

 

[camo7782]

HTTPS isnt about phishing protection (it never was), it is all about session hijacking and privacy protection.

is this something for laptops only? can a session be sniffed while using a wired router?

 

[Nightwalker]

is this something for laptops only? can a session be sniffed while using a wired router?

Yes it can, for example your ISP can make a man in the middle attack and inject code while you are browsing, others attackers can do it too, but it is much harder (ARP poisoning or HSRP spoofing ).

 

[camo7782]

Yes it can, for example your ISP can make a man in the middle attack and inject code while you are browsing, others attackers can do it too, but it is much harder (ARP poisoning or HSRP spoofing ).

but for this to work do I need the second check always on? Or the first one is enough to enforce SSL (if present) without calling the server first?

 

[Nightwalker]

but for this to work do I need the second check always on? Or the first one is enough to enforce SSL (if present) without calling the server first?

Just use default settings, the second check will block all unencrypted requests and thats isnt a good idea.