Re: https-only mode is broken

Op 16-1-2021 om 10:14 schreef Onno Ekker:
> Op 16-1-2021 om 10:07 schreef Onno Ekker:
>> Op 16-1-2021 om 01:00 schreef Michael Kaylor:
>>> Even on sites that only use https, I often get an error saying that a 
>>> secure connection is not available. After saying to let me through, 
>>> the site is in https anyways. That doesn't make any sense. I didn't 
>>> know where else to put this.
>>>
>>
>> https is meant to ensure that you are really on the site you wanted to 
>> visit. If the certificate is self-signed or uses a weak mechanism, it 
>> doesn't guarantee anything, so your connection is not secure and 
>> Firefox warns you for that.
>>
>> Onno
> 
> Small addition to the 2nd part: https is also meant to encrypt the 
> traffic, making it hard for hackers or men-in-the-middle to "see" what 
> you are doing.
> 
> A weak encryption mechanism like TLS 1.0, won't protect you.
> 
> Onno

While I'm at it: also an addition to the 1st part...

Not only self-signed certificates are not trusted. If the site uses a 
certificate that is issued by a certificate authority that is not 
trusted, Firefox also gives you a security warning.

Some CA's have been hacked or didn't really verify the source of a site. 
This can also happen for corporate websites on the local intranet. 
Internal websites can use certificates that are signed by their company, 
but Firefox doesn't come with all the world's companies signing 
certificates.

In such cases you can add your companies signing certificate to 
Firefox's certificate manager and the sites signed by that certificate 
will be trusted.

Onno