3

Firefox has a built-in toggle in settings to enforce HTTPS-Only mode. When enabled, the browser attempts to redirect to HTTPS every time and, if fails, blocks access to the website in the same way that it blocks access when, e.g., the SSL certificate is invalid etc. The mode ensures that only secure connections come through.

Please note this passage from the attributions sections in the end of the blog post:

We also want to acknowledge the work of our friends at the EFF, who pioneered a similar approach in HTTPS Everywhere’s EASE Mode. It’s a privilege to work with people who are passionate about building the web we want: free, independent and secure.

When I have the HTTPS-only option turned on in Firefox, may I still benefit from having HTTPS Everywhere add-on installed somehow, or is it completely redundant?

Improve this question

1 Answer 1

Reset to default
4

No. Firefox's HTTPS-only mode blocks all unencrypted requests by default. The HTTPS Everywhere plugin blocks some unencrypted requests by default. Therefore if you're using HTTPS-only mode (and not just mindlessly clicking "continue" every time it displays a warning), HTTPS everywhere is entirely redundant.

HTTPS-everywhere may be preferable for some users precisely because it does not block all unencrypted requests (by default), only those on sites it has previously identified as HTTPS-compatible. This may result in fewer warnings about blocked sites, and a smaller risk of alarm fatigue causing users to bypass the warning in the event of an actual attack. If you've already decided to eschew insecure connections entirely though, such discretion is unnecessary.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .