Hacker News new | ask | show | jobs
by isaacaggrey 5083 days ago
For users, HTTPS Everywhere is a must: https://www.eff.org/https-everywhere

Also, by using DuckDuckGo [1] over HTTPS you get the same ruleset in HTTPS Everywhere [2] even if you don't have the extension installed.

[1] https://duckduckgo.com/

[2] http://www.gabrielweinberg.com/blog/2010/09/duckduckgo-imple...

2 comments

The chrome extension at least seems to break a lot of sites. They're not kidding when they say it's alpha.

Pages include resources from https-everywhere'd domains and for whatever reason (mostly that the ssl versions of those resource urls aren't serving the same resources, or have broken certs) those resources fail to load. Within an hour of using it I'd seen it break 3 or 4 sites, so it got disabled.

You can manually disable it for individual sites, if you recognize that it's the problem, but if some minor resource fails to load it might not be obvious.

The reason the extension 'breaks sites' is because an alarming number of sites are happy to serve unsecure content all over the place. See the refernece to New York Times in the original article for an example.
And use HTTPS Finder to default to connecting via HTTPS before HTTP, then add a rule automatically to HTTPS Everywhere. https://addons.mozilla.org/en-US/firefox/addon/https-finder/