WARNING: New Firefox feature WILL break SQRL

[PHolder]

Firefox recently implemented and even promoted a new feature for HTTPS Only mode. Stupidly, they make this apply to localhost connections as well... If you enable this setting it will completely break SQRL login.

@Steve, you may want to note this on the podcast.

I made a warning graphic, which I stuck here https://snipboard.io/x3vck6.jpg

but will also paste here:

 

[JulioHM]

Official annoucement:

Firefox 83 introduces HTTPS-Only Mode – Mozilla Security Blog

Security on the web matters. Whenever you connect to a web page and enter a password, a credit card number, or other sensitive information, you want to be sure ...

blog.mozilla.org

I really doubt they will keep this moving forward to an official release without any backlash. That would break countless tools everywhere, not just SQRL. Off the top of my head... every domestic Wi-Fi router? Pretty much every IoT device in the market?

Changing this behavior needs to be followed by a clear standard on how to handle ad-hoc, isolated use cases. Maybe a defined standard on how to handle auto-generated self-signed certificates?

I'm curious to see the outrage if this ever makes into an official release without further consideration.

 

[PHolder]

break countless tools everywhere

Well for localhost it just times out. For sites actually on another device, it gives you a warning and lets you proceed or not.