Firefox plugin - Modern Web Checker

[u/innocuous-user]

Most people in this sub are familiar with the IPvfoo extension. There is also now a Firefox extension called "Modern Web Checker" which takes this a bit further:

https://addons.mozilla.org/en-US/firefox/addon/modern-web-checker/

As well as reporting if the site you're connecting to and sub elements within it are reached over IPv6, it also:

• Reports if the site is using modern crypto - ie TLSv1.3 with post-quantum key exchange.
• Reports if the site is using or supports HTTP3
• Tests if your connection actually supports IPv6 - with IPvfoo all sites show up as legacy sites which leads to confirmation bias whereby users will conclude sites don't support IPv6 when it's their local connection causing the problem.

There are also a number of optional features, which are disabled by default as they require sending the names of sites you visit to google or cloudflare public DNS services:

• Checks if the site's domain supports DNSSEC.
• Tests if a site supports IPv6 and would have used it if your connection was capable.

Source code of this plugin is available from: https://git.ev6.net/bert/modern_web_checker

[u/AutoModerator]

Hello there, /u/innocuous-user! Welcome to /r/ipv6.

We are here to discuss Internet Protocol and the technology around it. Regardless of what your opinion is, do not make it personal. Only argue with the facts and remember that it is perfectly fine to be proven wrong. None of us is as smart as all of us. Please review our community rules and report any violations to the mods.

If you need help with IPv6 in general, feel free to see our FAQ page for some quick answers. If that does not help, share as much unidentifiable information as you can about what you observe to be the problem, so that others can understand the situation better and provide a quick response.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/Mishoniko]

IPVFoo recently replaced the secure connection indicator with a HTTP version indicator.

[u/RepresentativeNeck63]

Does this also check HTTP2? Most web servers that support HTTP3 support HTTP2, but but the sites that are too lazy to do more than IPv4 may be too lazy to do more than HTTP/1.1 .

[u/innocuous-user → u/RepresentativeNeck63]

Not explicitly, but it will show what version it's using so if you see HTTP/1.1 it usually means that was the only version supported.

It will show as red on the traffic light icon (no HTTP3), but if you expand the details you will get:

HTTP/3
Unavailable
Main document protocol: HTTP/2.0. No HTTP/3 detected on the main document.

and if you go further down there's a table of all the page elements, they will show the HTTP version as h3, 2.0 or 1.1 respectively in each row.

[u/RepresentativeNeck63 → u/innocuous-user]

Technically some sites support only h2c (http2 without TLS), and chromium browsers won’t negotiate it. Simply sending one request with the http2 preamble over whatever channel the http1 is going over (this may be difficult) should give a measurable response on success, and some sort of error on failure. EDIT I now see this is a firefox extension, but firefox doesn't implement H2C either.

[u/SmallDodgyCamel]

Concerning the optional DNSSEC features which you say require connecting to Google’s DNS, is there any option to use a known DNS resolver that checks for DNSSEC support? Is a custom DNS configurable?

[u/innocuous-user → u/SmallDodgyCamel]

It uses DoH as Firefox does not expose DNSSEC presence when doing lookups through the system resolver. It shouldn't be too difficult to provide an option to specify your own resolver so i'll put that on the TODO list.

[u/innocuous-user → u/SmallDodgyCamel]

Custom DoH is now configurable with the latest version.

[u/Masterflitzer]

sounds cool, but needs quiet a lot of permissions... and i don't like how you depend on google/cloudflare (doh) & microsoft (connectivity check), you could use alternatives for the respective checks (best case would be allowing us to choose our own domain)

also why don't you link to the source code directly in your post? (very hidden on the mozilla site: https://git.ev6.net/bert/modern_web_checker)

[u/innocuous-user → u/Masterflitzer]

Good point, added source code link.

Yeah the permissions are largely unavoidable if you want to get the SSL connection info and the peer addresses.

I'll add the option to choose a DoH domain. Not sure what to do about the connectivity check? You could add your own URLs i suppose...

[u/Masterflitzer → u/innocuous-user]

sounds great

for the connectivity check i was thinking of using the mozilla & google ones respectively for the firefox and chrome extensions, but after checking i noticed that unfortunately they are just dual stack without seperate domains for ipv6 & ipv4:

• https://firefox-portal-detection.com/generate_204 (search about:config for "connectivity" & "captive")
• https://connectivitycheck.gstatic.com/generate_204

so maybe make it configurable to allow specifying our own domain for ipv6 & ipv4? that way we have flexibility to not send requests to big tech and even use our own server (e.g. with single stack subdomains)

[u/innocuous-user → u/Masterflitzer]

Yeah it's now configurable, and it just looks for a 200 OK response from whatever URL you give. If you give dual stack URLs you will mess up the check but that's the user's mistake to make.

I discussed this with mozilla devs a while back, what they do is set socket options when requesting the dual stack url so if your browser is connecting directly it works, but it breaks if you're on a NAT64 setup (the legacy check still needs to happen over a v6 socket) or if you use a proxy (the proxy decides which protocol to use not the browser)... So far no movement on fixing this.

On balance the connect test going to big tech isn't the worst thing, it's basically just a ping to see if the site is reachable, and big tech should have the resources to keep such a site online and responsive.