Export to GitHub

https-finder - Help.wiki

HTTPS Finder Help (Updated for version 0.77)

Topics:

About the Settings

Whitelisting

Detection Types

Writing Rules

Troubleshooting

Hidden Settings

Accessing the Preferences

In Firefox 4.0+, click Tools (Alt+T), expand the HTTPS Finder menu, and click Preferences.

http://www.kevinajacobs.com/hfwiki/toolsMenu.jpg

About the Settings

General:

http://www.kevinajacobs.com/hfwiki/prefsmain.JPG

Under General Preferences there are four main settings: * "Enable HTTPS Finder" will control whether or not HTTPS Finder functions as you browse. This is the same as disabling the extension in the Firefox Addons list, but does not require a restart to take effect.

  • "Do not prompt to save HTTPS rule" does just what it says. You will not be prompted to create any HTTPS Everywhere rules. However, the rules will not be created automatically. This should only be checked if you have a specific reason why you're not using HTTPS Everywhere.

  • "Enable HTTPS Found alerts (if auto-enforce HTTPS is disabled) is only available if “Automatically enforce HTTPS when available is off. Unchecking both of these boxes will result in no drop down alerts of any kind. However, detection will still happen in the background. You can still periodically check found domains and create rules from within the Advanced tab.

  • "Automatically forward to HTTPS if available" will automatically redirect you to the secure page when HTTPS Finder detects it. It is important to realize that depending on the website, services offered over HTTPS may be different than those offered over HTTP (For example, a site may redirect to a special login page as soon as an HTTPS connection is established). It is recommended to leave this feature enabled, and simply whitelist any domains that you want HTTPS Finder to ignore in the future.

Advanced:

http://kevinajacobs.com/hfwiki/prefsadvanced.JPG

  • "Use HEAD detection first (Fall back to GET if not supported by server)". GET and HEAD are two types of HTTP requests. HEAD detection uses less bandwidth and provides faster detection results on most websites. However, some websites don't support HEAD requests and will return non-“OK” HTTP status codes. When using HEAD first, HTTPS Finder will try to catch these cases and retry using GET detection. Unchecking this will only slow down HTTPS detection in most cases, but may give more accurate results in some cases.

  • "Show rule preview" uses a popup dialog to show you the HTTPS Everywhere rule generated by HTTPS Finder. This window allows editing of the rule before saving. Click "Cancel" to go back without saving a rule, or "OK" to save the rule as it appears in the window.

  • "Auto-dismiss alerts after (seconds)". This setting provides a time-out, after which any HTTPS Finder notifications will be automatically dismissed (without requiring that the user close the alert). Valid timeouts range from 0-60 seconds.

Whitelisting

http://www.kevinajacobs.com/hfwiki/whitelist.JPG

Whitelisting allows you to specify domains that you want HTTPS Finder to ignore (i.e., not attempt HTTPS detection or enforcement). You can Add, Remove, or Modify whitelist rules in the Preferences window.

Whitelist rules are matched by hostname. For example, to whitelist Google search, you could add the rule "www.google.com". Note that with this rule only, HTTPS Finder will still detect on "google.com". Some websites forward "theirdomain.com" to "www.theirdomain.com", but if you want to be sure you're whitelisting a host, you can add both "www.google.com" and "google.com".

HTTPS Finder also allows wildcard subdomains. For example, if you whitelist "*.google.com", all Google subdomains will be whitelisted (Mail.google.com, Code.google.com, Www.google.com, etc). Note that google.com is not covered in this rule, because it's not a subdomain.

Discovery Results

HTTPS Finder saves detection results (good and bad) for the session, and will not try to redetect on already-discovered domains. If a domain is saved as good, HTTPS enforcement will happen immediately rather than waiting for a detection response to come back from the remote server.

Clicking “Clear All Results” or “Clear Temporary Whitelist” (in the Firefox Tools menu) will reset all good and bad saved results. New detection requests will be started for any new page visited. Note that if the browser history is cleared, or an individual page is removed from history, it will also be removed from the HTTPS Finder discovery list.

At any time, you can check this list and create HTTPS Everywhere rules from it.

Writing rules

Writing HTTPS Everywhere rules is as simple as clicking “Save Rule” from an alert dropdown, or “Create Rule” from the Session Discovery Results in the preferences menu. Due to HTTPS Everywhere limitations, a new rule won’t take effect until Firefox restarts. HTTPS Finder will not alert after writing a rule (before restarting). If you're having trouble with a certain rule, or want to learn how to edit the HTTPS Everywhere rule in the "Rule Preview" window, go here to learn more: https://www.eff.org/https-everywhere/rulesets

Troubleshooting

---Rules not working

You can see all of your HTTPS Everywhere rules in the following locations:

On Windows: %APPDATA%\Mozilla\Firefox\(your profile directory)\HTTPSEverywhereUserRules

On Linux: ~/.mozilla/firefox/<profile folder="">, where ~ is your Home folder.

On Mac: ~/Library/Mozilla/Firefox/Profiles/<profile folder=""> Or ~/Library/Application Support/Firefox/Profiles/<profile folder="">, where ~ is your Home folder.

First, try deleting the problematic rules, then recreate them with the newest version of HTTPS Finder. If this does not work, see the instructions for rule writing here: https://www.eff.org/https-everywhere/rulesets. You can then try to edit the rule before saving it using the Rule Preview window.

---HTTPS not being detected

If HTTPS is not being detected on a site that you visit, when you know that HTTPS is available you can try the following:

Go to HTTPS Finder Preferences > Advanced > uncheck "Use HEAD detection first". It's possible that the server is sending back a non-standard code when it receives the request. Unchecking this will use GET detection only.

If that doesn't solve it, there could be a problem with the certificate. HTTPS Finder will not alert when any of the following certificate errors are present: * Not Verified/Unknown

  • Certificate Revoked

  • Certificate Expired

  • Certificate Not Trusted

  • Issuer Not Trusted

  • Issuer Unknown

  • Invalid CA

  • Usage Not Allowed

Verify that the website that you're trying to access does not have an invalid SSL certificate.

If you're still having trouble, email httpsfinder@gmail.com for support

Hidden Settings

To access these preferences, navigate to "about:config".

  • "extensions.httpsfinder.appendVersionTagToRules" will control whether or not the HTTPS Finder version tag comments are appended to saved rules. These are used for troubleshooting, but if you submit rules to the HTTPS Everywhere project, it may be easier for you with this setting disabled. (Introduced in 0.78)

  • "extensions.httpsfinder.allowSelfSignedCerts". If set to true, a special alert will appear on sites that offer a self-signed certificate. It is recommended to only use this if you know what the dangers of a self-signed certificate are, as well as why you want to use a self signed certificate in the first place. Note that auto-enforce HTTPS will not work on self-signed sites. Create an HTTPS Everywhere rule if you wish for this enforcement to take place. (Introduced in 0.79)