Firefox 70 will start marking HTTP pages as insecure

Firefox Developers presented Firefox's move to mark all pages opened over HTTP with an insecure connection indicator. The change is scheduled to be implemented in the Firefox 70 release scheduled for October 22nd. In Chrome, an insecure connection warning indicator for pages opened over HTTP is displayed since release
Chrome 68proposed in July last year.

Also in Firefox 70 is planned remove the "(i)" button from the address bar, limiting itself to the permanent placement of the connection security level indicator, which also allows you to evaluate the state of code blocking modes for tracking movements. For HTTP, the security issues icon will be explicitly shown, which will also be displayed for FTP and in cases of certificate issues:

Firefox 70 will start marking HTTP pages as insecure

Firefox 70 will start marking HTTP pages as insecure

It is expected that displaying an insecure connection indicator will encourage site owners to switch to HTTPS by default. By Statistics Firefox Telemetry service, the global share of page requests over HTTPS is 78.6%
(a year ago 70.3%, two years ago 59.7%), and in the USA - 87.6%. Let's Encrypt, a non-profit, community-controlled CA that provides free certificates to anyone, has issued 106 million certificates covering about 174 million domains (up from 80 million domains a year ago).

The move to mark HTTP as insecure is a continuation of earlier attempts to force the move to HTTPS in Firefox. For example, since the release Firefox 51 A security issue indicator has been added to the browser, which is displayed when accessing pages containing authentication forms without using HTTPS. Also started restriction access to new Web APIs - in Firefox 67 for pages opened outside a protected context, displaying system notifications through the Notifications API is prohibited, and in Firefox 68 insecure accesses block requests to call getUserMedia() to gain access to media sources (for example, camera and microphone). The "security.insecure_connection_icon.enabled" flag was also previously added to the about:config settings, which allows you to optionally enable the insecure connection flag for HTTP.

Source: opennet.ru

Add a comment