gHacks technology news » ssl https http://www.ghacks.net A technology blog covering software, mobile phones, gadgets, security, the Internet and other relevant areas. Tue, 24 Nov 2009 20:14:29 +0000 http://wordpress.org/?v=2.8.6 en hourly 1 Force SSL HTTPS Connections In NoScript http://www.ghacks.net/2009/03/31/force-ssl-https-connections-in-noscript/ http://www.ghacks.net/2009/03/31/force-ssl-https-connections-in-noscript/#comments Tue, 31 Mar 2009 08:07:56 +0000 Martin http://www.ghacks.net/2009/03/31/force-ssl-https-connections-in-noscript/ SSL connections which you can identify by the HTTPS protocol in the address bar of the web browser provide additional security in comparison to the HTTP protocol. This is why many companies use SSL on security sensitive pages of their website which usually involve financial transactions or personal information. To put it bluntly: A bank not using SSL on their website cannot be trusted. HTTPS connections are encrypted which means the traffic is being protected from local network sniffers. There are however still attack points like keyloggers or viruses on the user’s system.

There is one additional problem concerning websites that do offer HTTPS connections on most of their network but not everywhere. Mouser over at Donation Coder mentioned a hidden setting in the NoScript (check my Firefox security profile for additional information) add-on of the Firefox web browser allowing to force HTTPS connections for listed websites. This is helpful in a few cases. Some websites offer both HTTP and HTTPS connections to their servers. Another possibility are websites that make use of HTTPS connections but not on all pages.

Users with the excellent No Script add-on installed can configure sites to always use a secure https connection when they are visited. This option can be accessed by right-clicking the NoScript icon in the Firefox status bar, selecting Options from the context menu, clicking on the Advanced tab in the configuration and there on the HTTPS tab.

https

New websites or pages that should be forced to use secure HTTPS connections can be added to NoScript in there. The use of wildcards is possible. Users should however note that this will not work on all websites. It will obviously not work on websites that do not offer HTTPS. There are also sites that automatically redirect HTTPS requests to HTTP. Google.com is a prime example of this. If you add google.com to the list you will notice a never ending loop when opening that website because of NoScript trying to force HTTPS and Google redirecting to HTTP.

Tags: , , , , , , ,

Related posts

]]> http://www.ghacks.net/2009/03/31/force-ssl-https-connections-in-noscript/feed/ 3