[HTTPS-Everywhere] The context menu has landed

[Drake, Brian]

Redirecting HTTPS (and HTTP) URIs may also have applications for:

   - optimisation (https?://(www.)?example.com/ → https://www.example.com/,
   where https://example.com/ would have redirected to
   https://www.example.com/ anyway);
   - enforcing user preferences; and, in particular
   - controlling content from untrusted domains (https?://apps.facebook.com/→
   https://example.com/fbAppGateway/).

The first point certainly seems worth paying attention to (the rule that
would usually be used, http://(www.)?example.com/ → https://www.example.com/,
is itself an optimisation, compared to http://example.com/ →
https://example.com/). (assuming example.com and www.example.com both have
valid certificates)

Perhaps on the second and third points, HTTPS Everywhere isn’t the best
software to use, but if you’re using it anyway, why not use it for as many
things as possible?

Wouldn’t it be easier to redirect all URIs anyway?

On Fri, Jun 24, 2011 at 0939 (UTC-8), Peter Eckersley <pde at eff.org> wrote:

> On Fri, Jun 24, 2011 at 02:13:06PM +0700, Ake K. wrote:
> [snip]
>
> While coding I made the assumption that we would never be redirecting https
> URIs.  But I now note that we have 37 rulesets which do this to avoid cert
> name mismatches.  So it's a bug, and I'll fix it :)
>
> --
> Peter Eckersley [snip] <%2B1%20415%20436%209993>
> _______________________________________________
> HTTPS-everywhere mailing list
> [snip] <https://mail1.eff.org/mailman/listinfo/https-everywhere>
>

--
Brian Drake

Alternate (slightly less secure) e-mail: brian at drakefamily.tk
Alternate (old) e-mail: brianriab at gmail.com

Facebook profile: Profile ID
100001669405117<https://ssl.facebook.com/profile.php?id=100001669405117>
Twitter username: BrianJDrake <https://twitter.com/BrianJDrake>
Wikimedia project username:
Brianjd<https://secure.wikimedia.org/wikipedia/meta/wiki/User:Brianjd>(been
inactive for a while)

All content created by me
Copyright<http://www.wipo.int/treaties/en/ip/berne/trtdocs_wo001.html>©
2010–2011 Brian Drake. All rights reserved.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.eff.org/pipermail/https-everywhere/attachments/20110625/af8b196a/attachment.html>