From 731627a2d45981ccc4e3299f705540a1876e3c97 Mon Sep 17 00:00:00 2001 From: pyllyukko Date: Fri, 23 Jul 2021 00:16:47 +0300 Subject: [PATCH] Enable HTTPS-Only Mode --- README.md | 1 + user.js | 5 +++++ 2 files changed, 6 insertions(+) diff --git a/README.md b/README.md index d89920b..e504c45 100644 --- a/README.md +++ b/README.md @@ -335,6 +335,7 @@ Improve visibility of security-related elements, mitigate shoulder-surfing ### Cryptography [TLS](https://en.wikipedia.org/wiki/Transport_Layer_Security) protocol related settings +* Enable HTTPS-Only Mode [ [1](https://blog.mozilla.org/security/2020/11/17/firefox-83-introduces-https-only-mode/) [2](https://www.feistyduck.com/bulletproof-tls-newsletter/issue_71_firefox_introduces_https_only_mode) ] * Enable HSTS preload list (pre-set HSTS sites list provided by Mozilla) [ [1](https://blog.mozilla.org/security/2012/11/01/preloading-hsts/) [2](https://wiki.mozilla.org/Privacy/Features/HSTS_Preload_List) [3](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) ] * Enable Online Certificate Status Protocol [ [1](https://en.wikipedia.org/wiki/Online_Certificate_Status_Protocol) [2](https://www.imperialviolet.org/2014/04/19/revchecking.html) [3](https://www.maikel.pro/blog/current-state-certificate-revocation-crls-ocsp/) [4](https://wiki.mozilla.org/CA:RevocationPlan) [5](https://wiki.mozilla.org/CA:ImprovingRevocation) [6](https://wiki.mozilla.org/CA:OCSP-HardFail) [7](https://news.netcraft.com/archives/2014/04/24/certificate-revocation-why-browsers-remain-affected-by-heartbleed.html) [8](https://news.netcraft.com/archives/2013/04/16/certificate-revocation-and-the-performance-of-ocsp.html) ] * Enable OCSP Stapling support [ [1](https://en.wikipedia.org/wiki/OCSP_stapling) [2](https://blog.mozilla.org/security/2013/07/29/ocsp-stapling-in-firefox/) [3](https://www.digitalocean.com/community/tutorials/how-to-configure-ocsp-stapling-on-apache-and-nginx) ] diff --git a/user.js b/user.js index fd6261a..d0ee5e8 100644 --- a/user.js +++ b/user.js @@ -1007,6 +1007,11 @@ user_pref("browser.offline-apps.notify", true); * SECTION: Cryptography * ******************************************************************************/ +// PREF: Enable HTTPS-Only Mode +// https://blog.mozilla.org/security/2020/11/17/firefox-83-introduces-https-only-mode/ +// https://www.feistyduck.com/bulletproof-tls-newsletter/issue_71_firefox_introduces_https_only_mode +user_pref("dom.security.https_only_mode", true); + // PREF: Enable HSTS preload list (pre-set HSTS sites list provided by Mozilla) // https://blog.mozilla.org/security/2012/11/01/preloading-hsts/ // https://wiki.mozilla.org/Privacy/Features/HSTS_Preload_List -- 2.11.4.GIT