As wireless networks proliferate, web browsers operate in an increasingly hostile network environment. The HTTPS protocol has the potential to protect web users from network attackers, but real-world deployments must cope with misconfigured servers, causing imperfect web sites and users to compromise browsing sessions inadvertently. ForceHTTPS is a simple browser security mechanism that web sites or users can use to opt in to stricter error processing, improving the security of HTTPS by preventing network attacks that leverage the browser’s lax error processing. By augmenting the browser with a database of custom URL rewrite rules, ForceHTTPS allows sophisticated users to transparently retrofit security onto some insecure sites that support HTTPS
ForceHTTPS currently can only be configured as extension for firefox browsers. Hope other browsers are also included soon.
ForceHTTPS is for everyone to protect from all type of HTTPS based network attack.
Protection against attacks:
Cross-Site Scripting (XSS).
Cross-Site Request Forgery (CSRF).
HTTP Response Splitting.
document.domain.
Why use ForceHTTPS?
Browsers accept broken certificates and allow embedding of insecure scripts for two reasons:
• Compatibility: Many web sites have incorrectly configured certificates and embed insecure scripts. A browser that enforces strict error processing is incompatible with these sites and will lose users to a more permissive browser.
• Unknown Intent: Some site owners intentionally use self-signed certificates and host portions of their site over HTTP because these mechanisms provide protection from passive attackers and they believe the risk of an active attack is outweighed by the cost of implementing HTTPS fully.
ForceHTTPS is not a defense against phishing, but it complementsmany existing phishing defenses, such as SiteKey,the Yahoo! Sign-in Seal, and Chase’s Activation Code, by instructing the browser to protect session integrity and long-lived authentication tokens.
ForceHTTPS comes with preconfigured protection for Gmail, PayPal, American Express, Bank of America, Chase, and Fidelity.
Download ForceHTTPS here
You must log in to post a comment.