search

EFForg / https-everywhere

A browser extension that encrypts your communications with many websites that offer HTTPS but still allow unencrypted connections.
https://eff.org/https-everywhere
Other
3.37k stars 1.09k forks source link

colorpalettes.net : the site is completely different when upgraded to https #17413

Closed geekley closed 5 years ago

geekley commented 5 years ago

Type: ruleset/website issue Domain: colorpalettes.net

When visiting the home page of http://colorpalettes.net, HTTPSE upgrades it to https://colorpalettes.net. The problem is that they made the https version available, but it's a completely different page (this is so wrong!). And you can see its a "default" page that they just didn't configure properly.

I believe HTTPSE should add a rule for not auto-upgrading this site to HTTPS, so if someone types colorpalettes.net it goes to the HTTP version. Of course, in this case, the extension should still display the warning before entering the HTTP version if the user has "block all unencrypted requests" enabled.

Or something like this. To be honest, I don't even know what should be the expected behavior of HTTPSE in this case (because what if they fix it later and make a proper https???). Then again, the way it is currently, you don't even get to see that there is a different HTTP version so you can disable it for the site... even if you explicitly type it with http:// before.

This seems like a complicated case...

pipboy96 commented 5 years ago

Currently, there is no ruleset for this domain. Do you have EASE (Encrypt All Sites Eligible) enabled?

geekley commented 5 years ago

Sorry, I don't know what this is (it's in portuguese). I have enabled the option that would be "block all unencrypted requests", which forces encrypted requests, and prevents me from acessing a site in HTTP by mistake. The one that displays a warning if I try to go a site that can't be upgraded to HTTPS. Is that it?

I don't have enabled what would be about "mixed content ruleset".

geekley commented 5 years ago

My browser is Opera, by the way.

pipboy96 commented 5 years ago

You just need to add an exception to this website.

geekley commented 5 years ago

Yeah, I did that. If I disable for this site, it works for me.

My worry is, what do you guys do for cases like this? I understand that it's the site's fault, and you can't cover every case of misconfigured site.

Is this common? Because if it is, its possible that, by using the extension, I end up coming across other sistes that get redirected to a completely different HTTPS version... without even realizing that there is a HTTP version that's different.

pipboy96 commented 5 years ago

Sadly, we don't have any way to disable redirecting any website for all users. It would be a serious security issue if we were able to.

geekley commented 5 years ago

Yea, I understand. Is there, at least, a way to know when the page has been redirected to HTTPS by the extension versus naturally by the server?

pipboy96 commented 5 years ago

You may use Network tab of DevTools.

geekley commented 5 years ago

Hmm maybe it would be good if the extension button "counted one" for the page upgrade, in addition to the amount of resources it upgraded within the page. Just an idea. But anyways, I guess you can close this issue then. Thanks for the help! :)

pipboy96 commented 5 years ago

@geekley I can't. I'm not an employee of EFF.

geekley commented 5 years ago

Oh really? Well I can't close it myself either, it seems... thats weird... I mean, github is weird... thay make open issues (that need attention) green and closed issues (the ones you solved) red...

pipboy96 commented 5 years ago

@zoracon Close please.

RemakingEden commented 5 years ago

Hmm maybe it would be good if the extension button "counted one" for the page upgrade, in addition to the amount of resources it upgraded within the page. Just an idea. But anyways, I guess you can close this issue then. Thanks for the help! :)

@geekley This is a interesting find! It does seem to be set up very unusually. Ive just checked on my browser and if I have encrypt all sites and it redirects I get a 1 below the extension. See below. Is it not the same for you?

screenshot from 2019-02-11 20-56-52

geekley commented 5 years ago

In this case it is the same, it shows 1 for me too, but I think that's not because of the redirect itself, it's probably something within the page that was upgraded. If I visit it by explicitly typing https, it also shows the same 1. If I visit http://example.com, for... example... then it redirects to https but it doesn't show 1 because the page doesn't contain any http resource that the extension upgraded.

geekley commented 5 years ago

I'm assuming the purpose of the number is so that you know when the extension is doing something on the page (so that, in cases like this, where it breaks the page, at least you know it). Otherwise... what would be its purpose?

If that's the case, I think it should count everything the extension might be changing on the page, including:

Well... if we are going to discuss this, should I turn it into a separate feature request?

geekley commented 5 years ago

Oh, I think I interpreted the meaning of the number incorrectly... I thought it was the total resources the extension upgraded (which makes more sense for me, since that's what adblockers show), but it seems to be the number of custom rules enabled for the site.

pipboy96 commented 5 years ago

@geekley Sadly, currently the counter is completely uninformative. We should either make it reflect the number of upgraded requests or deprecate it entirely.

zoracon commented 5 years ago

Noting the counter feedback for #16669 and closing out. The reason @geekley is not seeing EASE, is because Opera's release had some issues. I am reaching out to them to iron out release issues.

Closing out.