[RESOLVED] Force HTTPS

[RD]

NS 2.3.8
FF 11

Hi,

I've added http://www.google.ie/ to Force HTTPS in NS. Works very well, except for Google Images.

I go to Google Images here:
https://www.google.ie/imghp?hl=en&tab=wi

I enter my search term, and the results page displays properly. But if I click any of the images I get what you see in the image below.



(Accepting cookies makes no difference)

Don't know if it helps, but if I search Google Images for pop, click the first image, I get the page above with this URL:

-https://www.google.ie/imgres?hl=en&biw= ... ,s:0,i:130


Thanks.

[Tom T.]

At a *very quick* glance, it seems that the problem is caused by the Google URL remaining even while attempting to redirect you to sites that may not support HTTPS connections. (Many don't, especially if their content is not particularly privacy-sensitive -- such as sites that host images publicly.)

Here's a test case: Search the images for "Discovery flyover" (it auto-completes; it was an historic moment in the US).

Resulting top link was to

Code: Select all

http://www.google.ie/imgres?hl=en&biw=1280&bih=671&gbv=2&tbm=isch&tbnid=pZd6_MsgEjMHeM:&imgrefurl=http://storify.com/producermatthew/photos-space-shuttle-discovery-flyover&docid=YEgYw7yWfVO4TM&imgurl=http://farm8.static.flickr.com/7084/6941025406_4d97f97296_z.jpg&w=640&h=480&ei=Pl2WT82xB5Kf6QHJ25S2Dg&zoom=1&iact=hc&vpx=627&vpy=157&dur=5042&hovh=194&hovw=259&tx=64&ty=215&sig=107028990858134937409&page=1&tbnh=149&tbnw=211&start=0&ndsp=15&ved=1t:429,r:2,s:0,i:70

Note that it's calling to storify.com, which in turn calls the image stored on Flickr.com. I just tried this: https:/ www dot flickr.com gets a 404 non-existent error, so we know that the site, http www dot flickr.com doesn't accept HTTPS connections.

The full story: I took this part of the entire link above (after "&imgrefurl" - image referrer URL)

Code: Select all

http://storify.com/producermatthew/photos-space-shuttle-discovery-flyover&docid=YEgYw7yWfVO4TM&imgurl=http://farm8.static.flickr.com/7084/6941025406_4d97f97296_z.jpg&w=640&h=480&ei=Pl2WT82xB5Kf6QHJ25S2Dg&zoom=1&iact=hc&vpx=627&vpy=157&dur=5042&hovh=194&hovw=259&tx=64&ty=215&sig=107028990858134937409&page=1&tbnh=149&tbnw=211&start=0&ndsp=15&ved=1t:429,r:2,s:0,i:70

Same error as you got.

So I took just this part, where the image actually lives:

Code: Select all

http://farm8.static.flickr.com/7084/6941025406_4d97f97296_z.jpg

(starting with http, including the pic's ID number, and ending with the file type, .jpg. Everything after that is extra info - height and width in pixels, etc.)

Try that. Beautiful!

OK, now your turn:

Code: Select all

-https://www.google.ie/imgres?hl=en&biw=979&bih=598&gbv=2&tbm=isch&tbnid=WmjMMgQAgxAQSM:&imgrefurl=http://vikkikidd.blogspot.com/2010/10/pop-pop-pop-up.html&docid=Ll7XpgI6cAaKxM&imgurl=http://4.bp.blogspot.com/_EXIXEth98D8/TLrjvII8SwI/AAAAAAAAABw/b5NPRTJN8I8/s1600/pop%252Bfor%252Bblog.jpg&w=985&h=667&ei=Ce6VT4OhFYS5hAfgw73gDQ&zoom=1&iact=hc&vpx=90&vpy=178&dur=588&hovh=185&hovw=273&tx=126&ty=82&sig=106041102688204292935&page=1&tbnh=110&tbnw=173&start=0&ndsp=18&ved=1t:429,r:0,s:0,i:130

Let's extract

Code: Select all

http://4.bp.blogspot.com/_EXIXEth98D8/TLrjvII8SwI/AAAAAAAAABw/b5NPRTJN8I8/s1600/pop%252Bfor%252Bblog.jpg

Works for me. In fact, it "POPped right up!

So, you can't use the Force HTTPS feature on sites that don't support it, but is it really necessary on your desired targets? ... although I fully agree with using HTTPS wherever it is supported.

I hope this helps.

[Guest]

Hi Tom,

Thanks for your help, and for taking the time to write such a lengthy explanation. Much appreciated.

I was able to fix the problem by using Redirect Cleaner.

I've also changed the NS Force HTTPS entry from http://www.google.ie/ to *.google.*/* which seems to cover a broader range of Google services.

Thanks again for your help.

Take care,
RD .

Works for me. In fact, it "POPped right up!

[Tom T.]

...I was able to fix the problem by using Redirect Cleaner.

Interesting add-on! With so many thousands of them out there, and new ones every day, it's hard to know them all. Thanks!

You might also like RefControl, for increased privacy.

I've also changed the NS Force HTTPS entry from http://www.google.ie/ to *.google.*/* which seems to cover a broader range of Google services.

I tried just
*.google.*
which seems to cover everything, including your image site, maps, etc.
Although NoScript's ABE feature uses regular expressions, the Force HTTPS feature seems to do fine with just the same basic wildcarding as the Whitelist -- a star after "google." covers all possibilities, with or without any number of sub-directories. Haven't tested extensively, though -- care to try, and give feedback?

Thanks again for your help.

Take care,
RD .

You're quite welcome, and thanks for the kind words.

Works for me. In fact, it "POPped right up!

[Guest]

Hi Tom,

Thanks for the tip on RefControl, installed and working great .

I've changed the NS Force HTTPS entry to *.google.* per your advice. Thanks for that too.

Having just recently upgraded FF from 3.6, I decided that while I'm at it I may as well tinker with FF a little to try and increase security and privacy. I never really went near NS's advanced settings before, and only found out about the Force HTTPS setting while researching another Addon. I'm going to take a look next at the ABE sub-forum to see what I can pick up.

I came across this rule over at Wilders, but want to learn a little more first, before I mess with ABE.

-ABE (Application Bounderies Enforcer) A simple rule like:
Site http://
Deny INC from https://
will make it so that unencrypted third party objects will not be loaded.

Thanks again, Tom, and hope you have a great weekend ,
RD.

[Tom T.]

Thanks for the tip on RefControl, installed and working great .

Glad you like it. For another leap in more finely-grained control, look at RequestPolicy. It dovetails beautifully with NoScript, because NS is not an image-blocker or content-blocker per se, but is targeted to *executable* content. RP shows all requests to other sites, which can eliminate "web bugs" and other privacy invasions. The developers of each wholeheartedly endorse using both. A bit more to mess with in menus, but a small price for the huge increase in control.

I've changed the NS Force HTTPS entry to *.google.* per your advice. Thanks for that too.

Add all of your online banks and other financial institutions (credit card company, etc.), *including on the Cookie tab*. -- in case one of them is lazy. In fact, this feature was prompted by the revelation that certain banks (coughbofacough) were serving an *insecure* login page, with a big black padlock by the user/pass fields (but none in the browser). You *sent* your creds over a secure connection, but the insecure portal is massively easier for phishers to duplicate, intercept, etc.

Very few financial sites commit this error any more. We like to think that the publicity created by the discussion and implementation of the Force HTTPS feature had something to do with that.

I never really went near NS's advanced settings before, and only found out about the Force HTTPS setting while researching another Addon.

My own personal suggestions for Advanced tab:

on Untrusted, checking all except "Hide <NOSCRIPT> elements".
Trusted: Uncheck all except "Show the <NOSCRIPT> element etc."

XSS: Remove all exceptions, but save them somewhere (in a text doc) in case they ever apply to you.
Over the years, the XSS checker has been refined more and more, reducing both false positives and necessities for exceptions.
If you do get an XSS warning, it is better to report it. Giorgio often has made further tweaks based on such reports.

I'm going to take a look next at the ABE sub-forum to see what I can pick up.

The ABE FAQ is the best place to start, and once comfortable with that, the ABE Rules .pdf has a slightly more technical discussion, still reasonably accessible. This should save a lot of forum-reading.

I came across this rule over at Wilders, but want to learn a little more first, before I mess with ABE.

-ABE (Application Bounderies Enforcer) A simple rule like:
Site http://
Deny INC from https://
will make it so that unencrypted third party objects will not be loaded.

Here's a rule suggested by Giorgio to defeat a particular type of Web attack called "NAT pinning".
The tech details are interesting but unimportant, and it shouldn't cause any harm (you'll get an ABE message if it blocks something):

Code: Select all

# NAT Pinning blockage (blocks outbound HTTP traffic to unlikely ports) 
Site ^https?://[^/]+:[0-35-7] 
Deny

Add this to the top of the USER ruleset.

Thanks again, Tom, and hope you have a great weekend ,
RD.

You're welcome, and back atcha.

[Guest]

Hi Tom,

Followed all your sugestions above, and installed RequestPolicy . Looks like RP will take some time to tame, but I'll stick with it.

I'm extremely grateful for all the extra help and advice you've provided.

You are a gentleman and a scholar .

[Tom T.]

Hi Tom,

Followed all your sugestions above, and installed RequestPolicy . Looks like RP will take some time to tame, but I'll stick with it.

I'm extremely grateful for all the extra help and advice you've provided.

You are a gentleman and a scholar .

And you are too kind... but who am I to argue?

(seriously: for volunteer work, a few kind words mean a lot. Thanks.)

[Thrawn]

<snip>So, you can't use the Force HTTPS feature on sites that don't support it, but is it really necessary on your desired targets? ... although I fully agree with using HTTPS wherever it is supported.

As mentioned in another thread, I recommend HTTPS Finder for this job. It probes the sites you visit for HTTPS support, and can switch you over automatically, as well as having the option (like NoScript) to secure your cookies.

If you do use NoScript to force HTTPS, you might also benefit from using the Perspectives addon to help you deal with certificate errors, on sites that have a HTTPS connection but don't use it properly.

[Tom T.]

....If you do use NoScript to force HTTPS, you might also benefit from using the Perspectives addon to help you deal with certificate errors, on sites that have a HTTPS connection but don't use it properly.

Funny story: Way back when, while still using IE (at least to get MS Updates, before discovering that I could get them with Fx, I used to do a manual force of secure updates by using https://update.microsoft.com. Got a "certificate mismatch error".

Wrote to MS about it, at the site for reporting vulns, not knowing where else to send it. Got a reply, "Not my job (of course! ), but will pass this along to (whomever)". No response from (whomever). But about three months later, the certificate was fixed.

Epilogue: When it needed to be renewed a couple of years later, they regressed to the same mismatch.

Didn't bother me, but it was ironic that their own update site triggered warnings in their own browser.

Click the link. Firefox will give you the same error.

This Connection is Untrusted

You have asked Firefox to connect securely to update.microsoft.com, but we can't confirm that your connection is secure.

Normally, when you try to connect securely, sites will present trusted identification to prove that you are going to the right place. However, this site's identity can't be verified.
What Should I Do?

If you usually connect to this site without problems, this error could mean that someone is trying to impersonate the site, and you shouldn't continue.
Technical Details

update.microsoft.com uses an invalid security certificate.

No comment...

... but probably why Giorgio suggested that one not "force HTTPS down the throats of sites that don't support it" -- too many of those errors around.