Security experts welcome Firefox encryption move
According to Patrick McManus, a network developer for Mozilla, this helps protect against passive eavesdropping, and also provides some integrity protection for data.
It does not protect against active man-in-the-middle attacks, however, so he encouraged the use of full encryption via https for everyone who was able to do so.
"But if you have long tail of legacy content that you cannot yet get migrated to HTTPS, commonly due to mixed-content rules and interactions with third parties, opportunistic encryption ... is a strict improvement over the cleartext alternative," he wrote in a blog post describing the new feature.
He added that there are several cases in which the browser will revert to regular, unencrypted traffic, such as if the clients don't use the right protocols, or if the opportunistic encryption port is unaavilable.
Some protection is better than none, agreed Richard Blech, CEO at Irvine, Calif.-based Secure Channels, Inc.
"Firefox has taken a few steps in the right direction here," he said. "For people forced into using HTTP, this is substantial."
The new standard removes almost all barriers to encrypting Web traffic, said Terence Spies, CTO at HP Security Voltage.
"It doesn't resist attackers that can actively alter traffic, but keeps data private from attackers that are passively recording the contents of network connections," he said. "If site administrators can enable encryption with a simple configuration switch, it moves us toward an Internet where data is encrypted by default. It doesn't solve every security problem, but raises the default security level from unprotected to privacy protected."
However, the encryption doesn't get turned on automatically, warned Tod Beardsley, engineering manager at Boston-based Rapid7 LLC.
"The web server must be configured to support the Alternative Services specification, which means there needs to be action from each individual website operator in order to make this work," he said.
In effect, the said, the web server is telling the browser that an encrypted version of a Website is available somewhere else.
"The idea is, if content providers can make their content available encrypted, and let browser know where to find it, users don't have to do anything special in order to enjoy a minimum level of encryption," he said.
However, this is much easier than rolling out both full-blown TLS with a real certificate authority and instrumenting your existing site to forward along the usual way, he said.
Beardsley pointed out that there's a browser plugin called HTTPS Everywhere that does something similar, and has been promoted by the privacy group Electronic Frontier Foundation for the past four year.
"This has seen some success among people who were already concerned with privacy," he said. "Ideally, if opportunistic encryption picks up, it shifts the implementation burden off the end-users."
The Internet Engineering Task Force first proposed opportunistic encryption as part of the HTTP 2.0 specification in late 2013.