6 ms·
Security upgrades are never opt-in, and for good reason. The status quo would remain in-secure. Every encryption suite upgrade, SSL software version, DNS versio
by jimmydorry 1mo ago
Security upgrades are never opt-in, and for good reason. The status quo would remain in-secure. Every encryption suite upgrade, SSL software version, DNS versions, etc. maintained backwards compatibility for a window then closed it... just like we have seen here with manifest v2 -> v3.
"Please stop looking at all network requests, especially when you don't need to."
doesn't result in action... while:
"You can no longer look at all network requests" requires extension makers to update to the new paradigm.
- franga2000 1mo agoNew versions of encryption suites don't remove core functionality. This is like TLS removing SNI because it leaks information. It does, but the solution is ESNI, not removing SNI all together. It's not "please stop looking at network requests", it's "ask the user for informed consent to look at network requests". Make it a big scary red warning if you want to. Definitely don't auto-grant it to existing extensions. There are many options that don't involve removing functionality. It's like when Google removed SMS and clipboard permissions because they used to be too broad. People were pissed, a bunch of apps were killed, Google's walled garden got reinforced...
- jimmydorry 25d agoYou're being naieve if you don't think SNI will be fully deprecated in the future when a standard is settled on and reaches wide-adoption. Scare prompt fatigue is real. If you're constantly blasting users with "XXX wants to do Y" which sounds scary, you're training them to just accept without thinking.
- franga2000 25d agoWell yes, SNI will be removed, when ESNI reaches far enough adoption. That's my point! ESNI does what SNI does, but securely. You fix an insecure implementation by replacing it with a secure implementation, not removing the feature completely.