3 ms·

> ... a system where ... information about the domain being visited is displayed from various sources (e.g. Google, or known phishing domain databases like Phis

> ... a system where ... information about the domain being visited is displayed from various sources (e.g. Google, or known phishing domain databases like PhishTank) that have a global network picture and hence are in a unique position to tell very early on whether a certain domain is untrustworthy. So, a trusted third-party, then? To, you know, certify the site? Like... a Certification Authority, perhaps? > If this is the first time you are visiting this website, a warning message will appear. Your browser will provide some useful information about this site (see below) and ask you whether you want to continue and really visit this site. How's that going to work when visiting any of the majority of sites today that pull in resources from perhaps 20 or more different domains? Google Analytics, some other analytics, ads, all the trackers, ... On a whim, I just pulled up CNN's web site [0]. uBlock Origin reports a total of 21 domains. How is the average user supposed to know if zor.fyre.co is legitimate -- or a tracker or a phishing site or "evil Russian hackers" and shouldn't be trusted? There's a lot that's wrong with the current state of PKI on the web (too many CAs, questionable CAs, etc.) but that doesn't mean we should just throw it all out tomorrow. We're stuck with it -- at least until something better is devised and rolled out (which would take years!) -- so the best we can do is hope for continued incremental improvements, such as TLS 1.3. [0]: http://www.cnn.com/ http://www.cnn.com/

rictic 10y ago
I don't want a web where every time a user visits a new domain they see a scary interstitial warning that asks them to make a trust decision. We have too many centralizing forces already.
- Crosseye_Jack 10y ago
  > I don't want a web where every time a user visits a new domain they see a scary interstitial warning that asks them to make a trust decision. I don't want it either as it easily trains users to click though it. User goes to new website: "Oh yeah I have to click allow <CLICK>"... User returns to site but its now being MITM'ed: "Oh I thought I had clicked allow. <CLICK>"... Even if the warning is something like "the public key for this site has changed, do you wish to continue?" The gen public will click continue. The problem is not designing a system us on hacker news can use, understand and keep us secure but its building a system that "non-technical" (Throw in generalisation about parents/grandparents not understanding the interwebs here...) minded people can use, understand and be kept secured.
irq-1 10y ago
> How is the average user supposed to know if zor.fyre.co is legitimate The current system doesn't grant any legitimacy, it only binds a name to a cert.

rictic 10y ago

I don't want a web where every time a user visits a new domain they see a scary interstitial warning that asks them to make a trust decision. We have too many centralizing forces already.

Crosseye_Jack 10y ago
> I don't want a web where every time a user visits a new domain they see a scary interstitial warning that asks them to make a trust decision. I don't want it either as it easily trains users to click though it. User goes to new website: "Oh yeah I have to click allow <CLICK>"... User returns to site but its now being MITM'ed: "Oh I thought I had clicked allow. <CLICK>"... Even if the warning is something like "the public key for this site has changed, do you wish to continue?" The gen public will click continue. The problem is not designing a system us on hacker news can use, understand and keep us secure but its building a system that "non-technical" (Throw in generalisation about parents/grandparents not understanding the interwebs here...) minded people can use, understand and be kept secured.

irq-1 10y ago

> How is the average user supposed to know if zor.fyre.co is legitimate The current system doesn't grant any legitimacy, it only binds a name to a cert.