18 ms·

Ask HN: What feature would you want the web to “force” next, after HTTPS?

114 points by chiefofgxbxl 9y ago

We've seen the push for HTTPS in recent years accelerate and become more and more aggressive (in a good way). Browsers have arguably led this drive by notifying users that the pages they are viewing are "NOT SECURE", through the use of pad-lock icons in the URL bar or even notifications under textboxes (e.g. Firefox) [0]. Chrome, too, is driving this trend. And with users fearful of sending data over a "non secure connection", they'll be vocal enough to push website owners to fix this issue. --- So, if you could decide: what feature or measure would you want to see adopted as quickly as the push to make all sites use HTTPS? [EDIT: kudos if you describe how your new standard could be "forced", e.g. through a URL-bar icon, notifying users somehow, etc. How would you convince other developers and maintainers of large code-bases, websites, browser vendors, etc. that they should throw their support behind your initiative?] Think ambitiously too -- imagine your proposed feature would have the same backing and urgency as we have with HTTPS, with browsers (for better or for worse) authoritatively "dictating" the new way of doing things. --- [0] http://cdn.ghacks.net/wp-content/uploads/2017/03/firefox-52.0-warning-insecure-login.png [1] https://www.troyhunt.com/life-is-about-to-get-harder-for-websites-without-https/

tammuz18 9y ago
Is this some reverse-psychology attempt to point out how fascist it feels when the browser feels it's smarter than you and begins taking its own decisions?
avaer 9y ago
ML driven content blocking for ads and other garbage such as social widgets and beacons. Red screen warning as deceptive on any site that tries to hack its way around the filter.
- jdmichal 9y ago
  Wouldn't you by definition not be able to detect working around the filter? Because if you could detect it, why would it not just be another filter condition?
- chiefofgxbxl 9y ago
  Interesting concept.. one that Google certainly wouldn't implement in Chrome because of their ad-based revenue model. But I could entirely see a little privacy "eye" icon in the URL bar of Firefox, similar to the padlock icon we have now for HTTPS/certificates. The eye could turn red and display text for the site you are visiting based on analytics, beacons, web bugs, and so on. Or how about major social media sites have their icons placed in the URL bar if they have trackers / social media widgets on the current page. This way, it is made explicitly clear to the user that "{Insert social platform here} is tracking you on this page, even while you are logged out, don't have an account, ..." The difficulty with having the browsers force the standard is getting Google Chrome on board, since they have so many users.
bmh_ca 9y ago
Automated HSTS, revokable public key pins, and certificate transparency.
- sofaofthedamned 9y ago
  Agreed, but I'd add ipv6
  - dane-pgp 9y ago
    Agreed, but to those 4 things I'd add DANE TLSA (RFC 6698) and Certification Authority Authorization (CAA) (RFC 6844) as further lines of defence against rogue CAs.
syncerr 9y ago
I'd vote for DNS-over-HTTPS or similar tech. Encrypting domain name resolution should help mitigate a gateway or proxy (Comcast) from knowing or blocking sites you visit.
- throwaway2016a 9y ago
  I always found DNS to be one of the most compelling uses of the blockchain. Namecoin actually did a great job at this. Effectively if put into practice, ISPs would run name servers that effectively mirror the whole DNS system via blockchain. And if you really wanted to have ultimate privacy you could run it locally on your machine and there would be no way for anyone to know what domains you've looked up.
- sidcool 9y ago
  I second this. DNS is still a privacy killer
- artorias 9y ago
  Solid idea, I like it.
- swiley 9y ago
  DNS is a non-trivial amount of traffic to go moving from a lightweight UDP protocol to something like HTTPS. Furthermore, that would dramatically increase page load times (for reasonably sized pages) since HTTPs requires more turns.
  - criddell 9y ago
    > dramatically increase page load times This is true, but with a reasonable cache design, it shouldn't be too bad.
    - throwaway2016a 9y ago
      Unfortunately a single page load often contains files from many different domains. Sometimes 10+. So caching may be of limited use. Although this may be a nice driving factor to get eCommerce sites to stop putting 50 tracking pixels on every page.
SwellJoe 9y ago
It's not security related, but: Accessibility.
- throwaway2016a 9y ago
  I second this. Most of the other ideas here are either technologies that don't exist yet or things only nerds care about (I'm a nerd so I can say that). This would have a meaningful impact on the lives of many in an underserved community.
- jbob2000 9y ago
  Yep, browsers should have screen readers built in. It's ridiculous that you have to shell out $1000+ for a JAWS license (there are alternatives, but they need work).
  - SwellJoe 9y ago
    Yeah, I've tried using the free options to sort of test my products, but it's not a realistic test; the most useful work comes from people who use screen readers daily, but it's really hard to test if we've fixed the problem even when it's been identified so we have to go back and forth. And, I mean, there are accommodations and assistive technology built into the standards. It's just nowhere near as widespread as it should be, in terms of usage, and it's always an afterthought (if it is thought of at all) in frameworks and HTML templates and such. And, because most of the time an inaccessible site or app is so inaccessible as to prevent anyone who would notice from getting far enough in to complain. So, we need good tools for knowing when our stuff is broken from an accessibility standpoint. I think what I'm getting at is that it should be easy to see errors in accessibility, and maybe search engines should favor sites that at least make an effort.
    - extra88 9y ago
      The problem with testing with assistive technology yourself is you're not a real user who knows the tool well. Also, like browser testing, there are differences between different AT; VoiceOver is used by many visually impaired people but what it supports and how it works is different in a number of ways compared to JAWS or NVDA (e.g. VoiceOver doesn't have "form" and "browse" modes). Search engines giving more accessible sites a "buff" as Google now does for HTTPS sites is a good idea. They already do in a small way in that having things like proper headings are good for SEO but they could go much further. Google has their own Accessibility Developer Tools [0] add-on, they could make it a default part of Chrome Dev Tools and make it more prominent. https://chrome.google.com/webstore/detail/accessibility-developer-t/fpkknkljclfencbdbgkenhalefipecmb?hl=en https://chrome.google.com/webstore/detail/accessibility-deve...
atirip 9y ago
JavaScript Standard Library created that every browser has "installed" and updated automatically.
- Spivak 9y ago
  Or just stable JS APIs that you can specify on your scripts. <script vers="3.1"> </script> <script vers="4.2"> </script>
  - RonanTheGrey 9y ago
    Or both. I would love this so much..
  - vortico 9y ago
    Apparently this somewhat works. http://jsfiddle.net/Ac6CT/ http://jsfiddle.net/Ac6CT/
- bpicolo 9y ago
  Yeah. It's a real shame that the language we need batteries-included in the most (because of code size limitations) is one of the most deficient.
- swiley 9y ago
  I feel like the mess helps discourage it's use. I shouldn't need a Turing machine in order to read a text document.
  - girvo 9y ago
    While I agree with you, that ship has sailed I think. I'd rather see it take less bandwidth, less memory and less CPU time at least!
- JepZ 9y ago
  Sounds a little bit like making https://cdn.polyfill.io/v2/docs/features/ https://cdn.polyfill.io/v2/docs/features/ persistent between websites ;-)
Spivak 9y ago
Dropping TLS in favor of IPSec. Now every protocol is transparently secure by default and there's no chance of developers accidentally messing it up.
- swiley 9y ago
  IPSec is beautiful and definitely was the correct way to handle encryption. IKE and ISAKMP was the problem, that stuff is an absolute nightmare. Maybe now with IKE2 it might get better...
  - effie 9y ago
    > IPSec is beautiful. Could you elaborate?
- netik 9y ago
  Key management would be a nightmare here. IPSec has very long setup times, and every destination would need a new crypto configuration. This is exactly the problem that TLS was designed to solve, and IPSec and the web are a bad mix.
- effie 9y ago
  IPSec is a complex design by committee, with NSA's help. Schneier does not believe it will become a secure system. http://www.mail-archive.com/cryptography@metzdowd.com/msg12325.html http://www.mail-archive.com/cryptography@metzdowd.com/msg123... https://www.schneier.com/academic/paperfiles/paper-ipsec.pdf https://www.schneier.com/academic/paperfiles/paper-ipsec.pdf
mattl 9y ago
A simple way to block third party trackers/beacons that's on by default, with a simple one-click to disable it on that page load.
ScalaFan 9y ago
Default encrypted email communications
- swiley 9y ago
  That's not part of the web.
  - dredmorbius 9y ago
    Given that most people's email is probably through Web apps these days, that's probably not effectively true.
  - vortico 9y ago
    Even if you use a desktop client, email is part of the world wide web.
    - StavrosK 9y ago
      How do you figure that? If you're using a desktop client, it seems pretty exactly not part of the web.
      - vortico 9y ago
        It seems that I was confused with the definition of the web. I was synonymizing it with Internet. So never mind, email is not part of the web.
deepsun 9y ago
IPv6?
- cenourinhapt 9y ago
  This ^^^^
notzorbo3 9y ago
- A protocol for sites to get my public PGP key for server side use - The discontinuation of using SSL certificates for verification of website identities and a move to true fingerprinting ala SSH. - Deprecation of email or rather its insecurity. - Logins on websites with a public / private keypair ala SSH. - A resurgence in sites that let me pick my own anonymous username instead of Facebook, Google or Twitter logins and email addresses as UIDs. - Blocking of any and all forms of popups, including javascript popups, overlays, cookie banners, browser notifications. The web is rapidly becoming a place I don't want to visit anymore.
- swiley 9y ago
  > Deprecation of email or rather its insecurity. We would need something to replace it with, there is really nothing right now.
  - fosco 9y ago
    While I agree, there is definitely movement and recent movement [0][1] , I just wish I had the knowledge to contribute. I am great and figuring out how things work, breaking them and understanding them. Building from scratch is a bit above my head, albeit I have a few ideas.... [0] https://news.ycombinator.com/item?id=14708783 https://news.ycombinator.com/item?id=14708783 [1] https://magmadaemon.org/ https://magmadaemon.org/
    - swiley 9y ago
      We already have standards for encrypting/authenticating email transfer between mail servers and between the server and user agent. This doesn't solve the problem of mail being encrypted in transit. As far as I can tell the server operator can still read the user's mail. What we need is end-to-end encryption, lack of support in MUAs (iphone mail app, thunderbird etc.) is the problem here, it has really nothing to do with the server.
      - yorwba 9y ago
        > lack of support in MUAs (iphone mail app, thunderbird etc.) Thunderbird supports S/MIME out of the box and PGP through an addon, so I'm not sure what other kinds of end-to-end encryption you'd want to see. Not sure about the iPhone mail app.
linopolus 9y ago
A ban of everything JS except for these so-called web apps, which obviously need it. Make the internet great (performant/efficient/secure) again!
- swiley 9y ago
  Really what browsers need are profiles. Maybe a research profile that just supports submitting search forms and renders everything in the same colors and the same fonts and the same margins, and an app profile which lets pages do all the ridiculous JS crap.
  - linopolus 9y ago
    And websites supporting this. I recently came across some site providing a paper that wouldn't even load the raw text without JS.
- netcraft 9y ago
  Forgive me, but I just don't understand this sentiment at all. I understand your general frustration with over-engineered websites - but is it not your choice to visit that website? Do you not also have the ability to block javascript just like the scourge of flash websites before it? We aren't talking about vulnerabilities here though, youre just saying that there are websites out there that could do with less (or no) javascript but arent, so you want to "force" them to? Let me ask it a different way - do you have any reasonable expectation that your proposal will ever be accepted? That browser manufacturers will implement things to limit or block the functionality of js? Where would the line be drawn (and who would draw it) between the so-called web apps and everything else that isn't worthy? There already are some mechanisms in place to decentivize misbehaving websites such as the google rankings. But thats a far cry from a browser not supporting or displaying some warning when viewing one of those sites. Maybe im missing something - that there are these required sites that are misbehaving and we need some regulatory power to rein them in.
  - dmitrygr 9y ago
    Maybe im missing something You definitely are. Disable js and try browsing. Note the quadrupled battery life in your laptop.
grumblestumble 9y ago
Evergreen web browsers. Safari and IE11 continue to ruin my life.
- Analemma_ 9y ago
  Unfortunately this one is impossible even if every developer and browser vendor were all unanimously in favor. Edge-née-IE is evergreen now, but users have to upgrade Windows first, and that's not something that can be forced.
- dredmorbius 9y ago
  What do you mean by this?
  - grumblestumble 9y ago
    "evergreen" means self-updating, with a rapid release cycle. Chrome, Edge, and Firefox follow this model. IE (essentially a legacy browser at this point) and Safari don't.
    - dredmorbius 9y ago
      Thanks. This works in some instances. Not so much in others.
snomad 9y ago
I would love package systems and server admins to recognize the inherit danger in allowing the servers to call out to the wild. All internet facing servers should be allowed to only call out to white listed addresses.
- effie 9y ago
  Do you mean blocking all IPs except for those whitelisted? Obtaining the right whitelist seems to be time consuming task. If you control your servers and trust their software, why would you cripple its operation?
joshfraser 9y ago
Ending the NSA dragnet
pfraze 9y ago
A peer-to-peer hosting protocol which publishes user data outside of site silos while still "feeling" like a web app. Bonus feature: end to end encryption.
mathiasben 9y ago
VRML
frik 9y ago
Dear overlord, stop this shit. Don't force any web user over your agenda BS. Amazon.com worked fine from 1995 to 2016 with HTTP (only the login page was HTTPS). If you have a crappy ISP like Verizon or whatever, it's your own personal problem - 99% of the web user don't care about your problem. Maybe use a VPN to somewhere to an ISP you can trust. I stopped using Firefox because they turned mad. Chromium with some custom patches seems like a far better solution nowadays. Yet I see Google is too trying to destroy the open web with their PWA/AMP monoculture that is favored and listed on top of search results. We need the EFF and other "good" foundations to lobby for the end user - too many shady and corporate entities lobby against the end user, unfortunately.
- mLuby 9y ago
  There's often no ISP choice available. https://arstechnica.com/information-technology/2016/08/us-broadband-still-no-isp-choice-for-many-especially-at-higher-speeds/ https://arstechnica.com/information-technology/2016/08/us-br...
- schoen 9y ago
  I work for EFF and we have actively lobbied for sites, including Amazon, to adopt HTTPS by default for years. Even if you have some way to verify and be confident in your ISP's privacy practices, your data is going to pass through a lot of different ISPs' facilities, and you're not going to have any control of that.
davimack 9y ago
A truly obfuscatory browser: one in which everything sent to the server looked the same, regardless of which user, region, etc.
- swiley 9y ago
  curl -H "" -o stuff.html && elinks stuff.html I've been looking for a site I can run this on over TOR at random times for reading news but I haven't found one.
  - dredmorbius 9y ago
    Can elinks read from stdin?
    - swiley 9y ago
      links2 can, and both of them have --dump. The nice thing about doing it like this is that the file persists on disk so viewing a page is decoupled from fetching it (which is nice for a lot of reasons.)
      - dredmorbius 9y ago
        Yeah, I may have done that once or twice myself. https://ello.co/dredmorbius/post/naya9wqdemiovuvwvoyquq https://ello.co/dredmorbius/post/naya9wqdemiovuvwvoyquq Why browsers don't dump to disk in a format that makes for easy rendering ... I don't know.
- vortico 9y ago
  With addons which disable user agents, referrers, and other details, and by disabling Javascript, you can nearly achieve this with Firefox and Chrome. I've noticed that some website refuse to serve content without a user agent.
acosmism 9y ago
a distributed built-in password manager (a password-less web)
tomc1985 9y ago
- Make client-side certificate authentication mainstream. Fix the UI, UX - Standardize on some sort of biometric identification that actually works. I HATE two-factor :(
- conductor 9y ago
  1. Client-side certificates usage has privacy implications - https://github.com/tumi8/cca-privacy https://github.com/tumi8/cca-privacy 2. Is biometric really necessary? U2F tokens already exist and are standardized (maybe not officially, I'm not sure). Chrome and Opera already support it, Mozilla's support must be coming soon (meanwhile you can use an add-on).
  - tomc1985 9y ago
    I am sick of the actual motions of authenticating, and many of the 2-factor implementations out there today are terrible. (SMS, really? What happens when your phone is stolen? How do you protect against an angry lover? What a joke) U2F dongles aren't much better. Also, a quick glance at that link seems to indicate attacker needs some sort of MITM access? Is it anything more than a replay attack?
lousken 9y ago
Working version without javascript (unless it's crucial for the website). No opacity 0 animations, javascript only menus etc.
- roryisok 9y ago
  This should get more votes. It should be an internet requirement that a website has to be functional and readable without Js. I don't know how this could be implemented though
  - lousken 9y ago
    Just include <noscript> with style tag where it would include those fixes (regarding opacity), menus without js are not a problem in new browsers, css3 is powerful enough. There's even a repo with common elements done without a line of js - see https://github.com/you-dont-need/You-Dont-Need-JavaScript https://github.com/you-dont-need/You-Dont-Need-JavaScript
monk_e_boy 9y ago
Pay turn off ads. A certain percentage of visitors are asked to rate the content (to avoid paying) the rest of the visitors are automatically billed and pay the average rating. Each user can specify a maximum payment and can opt to view with ads if payment requested is too much.
- wwwhatcrack 9y ago
  Ever try ad-block? It's actually free.
  - monk_e_boy 9y ago
    How do you pay the people who create content?
    - wwwhatcrack 9y ago
      Not through ads.
nodesocket 9y ago
"grandmother" usable email encryption for the masses.
interdrift 9y ago
Destroy fake news (no pun intended).
deleted 9y ago
[deleted]
momania 9y ago
- A decent minimum password length, without any funky requirements, just the minimal length. - Being able to prosecute any company that stores passwords in plain text
- SideburnsOfDoom 9y ago
  - no max length on password at all, or allow a 3 digit number of chars. Never silently truncate passwords either. - never disable paste on a password field.
  - snarfy 9y ago
    You'll have half your users with passwords like '123'. You could say it's the user's fault and their account is compromised, but when it's half the users on your site, really your site is compromised. Better to have a minimum password entropy.
    - maemre 9y ago
      I understood the parent comment as the password length should be 3 digits long (hundreds of chars) rather than password itself.
      - SideburnsOfDoom 9y ago
        Correct, though I would phrase it as "the password can be 100s of chars long, if the user so chooses" i.e. No noticeable maximum length for people using password managers and generating 30, 50 or 100 char random passwords, but still insulated against attacks with endless streams of input data - it is acceptable to reject 10 000 char passwords as a hostile input designed to tie up server resources. I said nothing at all about what the minimum password length should be, and that's deliberate, it's a separate kettle of worms. But ok: I'm also not a fan of measures such as "password entropy" or "must contain at least one from column A and one from column B". Subjectivity, naive use and changing attacks have given these a bad reputation, often deserved. Password length is not subject to such changing moods. The parent posts comment, "A decent minimum password length, without any funky requirements, just the minimal length" is fine by me. I didn't want to add to that statement on the topic. With all the rules in the world, some people are going to have relatively weak passwords, and we cannot entirely eliminate that. But we can also allow and encourage strong passwords by - as an easy first and minimum step - removing deliberate misguided impediments like max lengths and disabling paste.
betaby 9y ago
IPv6, DNSSEC, P2P DNS and rootless DNS,
keymone 9y ago
hashcash and convenient end-to-end crypto everywhere
payne92 9y ago
Hard deprecation of the long tail of Javascript browser capabilities and incompatibilities. So much code and so many libraries are littered with "if (old version browser) do x, else if IE, do y, else, ..."
- frandroid 9y ago
  So IE should say "sorry I suck, switch to another browser?" Doesn't make any sense... I mean sites will already tell users they don't support older browsers.
  - freehunter 9y ago
    What would really be nice is to have a spec that either you follow or you don't. If you follow it, you follow all of it and it just works. If you don't Javascript is completely broken. It'd be a good incentive to get browser vendors on board.
    - bnjemian 9y ago
      I like it, not dissimilar from the shaming model that has contributed to HTTPS accelerating adoption.
    - will4274 9y ago
      This idea sounds great but it misses the reality on the ground - web standardization is broken. Compare C++ standardization. Most people are using two year old compilers. While the newest compilers do implement draft features, these features are almost all standardized in the next ~3 years. The standards are clearly versioned and you can put newer compilers into modes to check against older standards if your code needs to compiler on multiple compilers. Features are never removed. By contrast, on the web, everybody is running brand spanking new browsers. Experimental technologies are sometimes implemented before full draft standards are even written. Many or most drafts that are written never become standards. If they do become standards, it's often a decade or more away. Alternatively the living standards of what browsers actually support aren't versioned. It's not possible to put a browser into JavaScript 99 mode - the easiest way to check your code for conformance is to automate your test cases across a variety of browsers. And, features are sometimes removed because they are deemed security or privacy concerns, so conforming to an old standard is not sufficient to ensure proper functionality under modern browsers.
vfulco 9y ago
2FA everywhere, preferably with Yubikey (no connection but happy user)
- m-j-fox 9y ago
  Side question: Do you use your Yubikeys for GPG? I tried to make two identical keys with the same GPG key, but still I get "Please remove the current card and insert the one with serial number: ..." if I try to decrypt a file with the other key. I asked the internet a couple times but no one seems to know.
  - snarf21 9y ago
    This is the most important thing. It solves so may other inconveniences of the net. Your username should be your fingerprint. Your password should be 8 characters. You should have a 2fa fob that secures your account. So much less fraud and other attacks. I think this has the highest ROI.
- jonnytran 9y ago
  There was a link just 2 days ago on HN [1] about how 2FA has already been forced, but it's a mess b/c every site does it differently and usually in a way that's not secure. 1: https://news.ycombinator.com/item?id=14735759 https://news.ycombinator.com/item?id=14735759
irundebian 9y ago
Strict HTML, CSS and JavaScript parsing. One single error => Site won't be displayed. These lazy web devs need some more discipline!
- paulrosenzweig 9y ago
  I agree with this, but feel like there might be issues I'm not thinking of. Can anyone shed some light on why browsers are so tolerant today and why that might be a good thing?
5ilv3r 9y ago
I want a way to force sites to become static after they are rendered. Just frozen, as though they were on paper. I am tired of scrolling making menu bars move around or triggering popovers. Just give me a way to turn off javascript and any dynamic CSS junk after X amount of time. I looked into writing this as a firefox browser extension, but extensions now use javascript so we're all screwed.
- cgb223 9y ago
  Its not perfect, but try reader view on Safari. I use it alot to make various articles and blog posts more readable. There's also quite a few reader view plugins for Chrome, Firefox, etc
- Felz 9y ago
  You can effectively disable JavaScript with WebExtensions by injecting a script that overwrites all the properties of the document and window with undefined. Instantly crashes pretty much any script. If you want to do it sometime after page load, you could replace all those properties with a Proxy object instead, and have that object start throwing errors for any access after X time has passed.
- mabcat 9y ago
  I've been using this Kill Sticky bookmarklet, and it's turned out to be one of life's simple pleasures. Gets rid of menu bars and popovers. It's the most-used thing on my bookmarks toolbar by a factor of about eleventy babillion. It's not automatic like an extension would be, but you'll find you get 80% of what you want with a tiny bookmarklet. https://alisdair.mcdiarmid.org/kill-sticky-headers/ https://alisdair.mcdiarmid.org/kill-sticky-headers/
- iwalton3 9y ago
  I tried something like thiswith a user script to attack those fixed banners, but I found that it caused too much breakage. (For instance on Youtube you would not be able to use the menus.) I settled on hiding the fixed headers and other objects upon scroll down. (They can be brought back by scrolling up.) https://iwalton.com/wiki/#NoFixed https://iwalton.com/wiki/#NoFixed It would be nice if there was browser support, maybe something like tricking the page into thinking the viewport is as long as the page itself.
kuschku 9y ago
Getting rid of passwords. Passwords are the easiest way for others to get access to your accounts. A move to federated identity, with a standardized API, and integration with the browsers, would fix all these issues. You could easily use a federated identity provider with support for 2FA, and ALL your accounts would immediately work with 2FA. And, with federated identity, you can also run your own, if you don’t trust Google or Facebook login.
- curun1r 9y ago
  > And, with federated identity, you can also run your own, if you don’t trust Google or Facebook login. Sounds like OpenID...which was kind of a train wreck. One middle ground could be tighter integration between browsers, sites and password managers. With the right specification, sites could offer a "register with [1Password,KeePass,LastPass,etc]" button which would open the password manager and pre-fill all the fields from a password manager's identity record (i.e. if a user has multiple identity records, the password manager can prompt for the one to use.) If there's a need to choose a username, there should be a standard endpoint for checking uniqueness. Once all information is filled out, the password manager can generate a password based on the site's specifications, post the information back to the site, store the account details and the site's ToS in its database and update the browser page to the success url. There can also be a standard endpoint for password rotation so the password manager can periodically update the password without the user's involvement. This would still use passwords and for those that explicitly don't want to use a password manager, they could continue doing things the current way. But for the majority of us, it would be just like what you're talking about except that our identities would be stored locally in our password managers, giving us complete control over everything while automating as much as possible.
  - deleted 9y ago
    [deleted]
  - kuschku 9y ago
    That’s another one of these half-assed solutions that the world has too many of, just like credit cards or using SSN as auth. No. We’ve solved all these issues before, OpenID was a good solution, and OpenID Connect – a complete rewrite – can be used to replace it, and is used already for Google and Facebook login. Just use OIDC, on every page, and allow users to choose an identity provider. Problem solved.
tardo99 9y ago
A simple micropayments scheme that can be used on publications, music sites, whatever.
age_bronze 9y ago
Registration forms should be standardized. I want to have my "real" details, and my "fake" details ready to be entered into websites that want yet another registration. Why does every single website implement their own registration form with exactly the same details?! Why does every single web site re-implement the registration page slightly differently?! Ideally, I'd enter the registration page, the browser would list the things they want to know, I'd pick either my details or another set of fake details (for spammy websites or others u don't really care about), one click and registration complete.
- cgb223 9y ago
  This sounds like a great opportunity for a startup to create and capitalize on
  - catshirt 9y ago
    it's kinda been tried by proxy through authentication standards like OpenID. i wonder if the solution isn't to back off a little though. that is, standardize some process instead of (de?)centralizing authentication. something that gives developers more control, and users more familiarity, than OpenID.
    - chii 9y ago
      open ID moves the user away from your service, which i think is not what some sites want because they want more user info and control. that's why openid failed.
      - catshirt 9y ago
        agreed. tried to articulate that in my post! thanks :)
- sabujp 9y ago
  chrome already has variants of my information cached for forms
- 9y ago
molsson 9y ago
* SameSite cookies * CSP
O1111OOO 9y ago
Disclaimer on all sites about data collection (on sites that collect data): Precisely what data is collected, a list of the 3rd-parties the data is sent to, the policies of those 3rd-party sites, how long the data is held at the primary domain, how long the data is held at the 3rd-party sites, options for requesting that such data be deleted. Sites that act as a conduit for the collection and transmission of user data should be held accountable for the breach of such data.
kyledrake 9y ago
Ability to mark HTTPS site as "not secure" using HTTP headers if it's asking for things like logins and passwords. Would be useful for things like free static HTML web hosts and CDNs for combating phishing. Could be something put in CSP.
- krallja 9y ago
  Is that different from CSP form-action?
  - kyledrake 9y ago
    Yes. This wouldn't prevent a form from working, what it would do is warn the user that this site shouldn't be asking you for a password and may be trying to do a bad thing, instead of just showing a green bar and a "security lock" with the word secure on it.
joelcollinsdc 9y ago
Accessibility. Should be hard or impossible to build an inaccessible website. Tooling needs to be vastly improved.
roundupReady 9y ago
This is ridiculous. You are a complete moron who hates the open web. Shut up.
hedora 9y ago
Decentralization.
r1ch 9y ago
Start cracking down on bloated and unnecessary JS. Loading more than 1 script? More than X KBs of total JS? More than Y secs CPU time? "This page is slowing down your PC".
- ryan-allen 9y ago
  That'd be hilarious and tragic. Most of the internet would be flagged slow.
  - roryisok 9y ago
    And that would force devs to change them
    - ryan-allen 9y ago
      Devs aren't usually the ones in charge. Imaging trying to explain to an exec that you need to remove the analytics code from their website to speed it up for end users, not gonna happen!
api_or_ipa 9y ago
I'd like to see form validation get a badly needed overhaul. At the same time, we can punish sites that use shitty/inappropriate practices. This would vastly improve mobile experience especially.
tjoff 9y ago
Obtrusive prompt (UAC equivalent) required to load any javascript. How the web would be so much functional, to the point and responsive. Just imagine the electricity savings. The world truly would be a better place.
- Viper007Bond 9y ago
  I couldn't disagree more but there's plenty of browser add-ons that allow you to do this.
  - tjoff 9y ago
    The whole point would be that it would be mandatory. So that websites would need to do without javascript unless they really couldn't be usable without it. Noone will stop using javascript based on what I do locally.
- StavrosK 9y ago
  Why not just install NoScript? This seems like an easy problem to solve locally.
dredmorbius 9y ago
Standardise on a set of basic document types. Index page, article, gallery, search/results. Others as necessary. Specify standard elements and styling. Standardised metadata. Pages should have title, author, publication date, modification date, publisher, at a minimum. Some form of integrity check (hash, checksum, tuple-based constructs, ...). User-specified page styling. If I can load a page in Reader Mode, https://outline.com https://outline.com, or Pocket, I will (generally in that order). Every page having some stupid different layout or styling is a bug, not a feature. Web design isn't the solution, Web design is the problem. Users could specify their default / preferred styling. Night mode, reader support, etc., as standards. Fix authentication. PKI or a 2FA based on a worn identification element (NFC in a signet ring with on-device sensor is my personal preference), if at all possible. One-time / anon / throwaway support. Reputation associated with publishers and authors. Automated deprecation of shitposting users, authors, sites, companies. Discussion threads as a fundamental HTML concept. Dynamic tables: Sort, filter, format, collapse fields, in client. Charting/ploting data would be another plus. Native formula support. Persistent local caching. Search support. Replace tabs with something that works, and supports tasks / projects / workflows. (Tree-style tabs is a concept which leans this way, though only partially). Fix-on-reciept. Lock pages down so that they are no longer dynamic and can simply be referred to as documents. Save to local storage and recall from that to minimise browser memory and CPU load. Export all A/V management to an independent queueing and playback system.
jasonkostempski 9y ago
User prompts for JavaScript from other domains.
Giorgi 9y ago
SSL was forced by Google single-handedly. Developers scared that https might provide ranking factor, quickly moved to SSL. As for topic, I would like to see all mails clients rendering emails same god damn way.
- freehunter 9y ago
  And handling replies the same way. Far too often I see someone using IBM Notes send an email to someone using Outlook and when it gets to me the sender says "review the email chain below" and every damn line has another damn angle bracket. Not sure which client is adding it all in, but it makes it unreadable. >hello >>my name is bill >>>i'd like to have a meeting >>>>please provide your availability
  - theandrewbailey 9y ago
    >>>>Even worse, is when you have a really long line followed by a >short >>>>line that got moved because a word exceeded some unknown column >boundary. >>>>This isn't cool anymore, and anyone that implements it should be >shot.
exelius 9y ago
I think this is only really worth the headache for security issues. That said: - HSTS - DNSSEC - IPv6 in that order. I think for a long time, governments had no interest in pushing security and encryption because that would prevent them from mass data collection. I think minds are starting to change around that: poor security is much more likely to be exploited against a government rather than used in its favor (plus all the real criminals now have much better opsec these days so mass surveillance is much less effective).
- rmrfrmrf 9y ago
  I feel like I need more training for IPv6. For a long time, I've thought that it was a simple thing to enable and allow (and often our servers are dual stack). It turns out, though, that unless you really know what you're doing on the server side (i.e. overriding the horrible defaults for IPv6 resource allocation), you can end up with an inexplicably slow server that spits out bizarre errors. Anyone here have any recommendations on a book, course, etc. that covers IPv6 readiness?
  - topranks 9y ago
    More on the network side myself, and I thought I had v6 down, or at least the basics. What kind of resource allocation problems did you have on dual-stacked hosts? Windows/Linux/Other??
    - rmrfrmrf 9y ago
      For example, in Debian 7, routes.max_size is dynamically allocated for ipv4 and hard-coded to 4096 for ipv6. I eventually figured it out after searching for a while, but that's not something I'd expect to have to do (having been used to ipv4 working decently out of the box).
- deleted 9y ago
  [deleted]
delbarital 9y ago
It's very interesting that most people here mentioned changes only to the top layers while one of the most urgent problem is in the BGP protocol that help route traffic between ISPs. Many times in recent years governments and ISP used it to steal the traffic of entire countries, or to block websites.
- deleted 9y ago
  [deleted]
seltzered_ 9y ago
First thought when reading the headline: Backlinks. Jaron Lanier explains... https://www.youtube.com/watch?v=bpdDtK5bVKk&feature=youtu.be&t=15m45s https://www.youtube.com/watch?v=bpdDtK5bVKk&feature=youtu.be...
spuz 9y ago
IPFS
phkahler 9y ago
Fixed IP addresses for everyone. Also addresses that encode LAT/LONG. These are intended to increase traceability.
- DivisionSol 9y ago
  What? Why.
cwp 9y ago
Add SRV lookups to the HTTP standard. There's a tremendous amount of complexity and cost attached to the fact that browsers look up the IP address of the hostname and then connect to port 80. First, it's true that you can specify another port in the URL, but nobody does that because it's ugly and hard to remember. If you want to be able to send people to your website, you need to be able to tell people what the url is - "Just go to example.com". The minute you start saying "example.com colon, eight zero eight zero" you're screwed. With a SRV record in DNS, example.com could map to an arbitrary IP address and port, which would give us much more flexibility in deploying web sites. If you want a bare http://example.com http://example.com to work, you need to create an apex record for the domain. That can't be a CNAME that maps to another hostname, it has to be an A record that maps to an IP address. This means you can't put multiple websites on a single server with a single IP address, you have to have an IP address for each site. IPv4 addresses are already scarce, this just makes it worse. Also, port 80 is a privileged port in unix (which does the lion's share of web hosting). That means you have to run web servers as root. That, in turn, defeats the unix security model, and requires hosting providers to either lock down their servers and give limited access to users (cPanel anyone?) or give customers root access to virtualized operating systems, which imposes a tremendous amount of overhead. Virtual operating systems also impose a bunch of complexity at the networking level, with a pool of IP addresses get dynamically assigned to VMs as they come and go, DNS changes (with all the TTL issues that go along with that), switch configuration etc. These problems are all solvable and indeed solved, by really clever modern technology. The point is that it's all unnecessary. If browsers did SRV lookups, we could still be hosting like it's 1999, and putting all the tremendous progress we've made in the last 20 years into making it cheaper, faster, easier and more secure to build and run a web site. People that support the "open web" as opposed to "just make a Facebook page" should advocate for SRV support in HTTP. This doesn't actually have to be "forced" on users of the web - it'd have to be forced on browser implementors, hosting providers and web site operators. If the transition was handled well, users wouldn't even notice.
- harryh 9y ago
  This means you can't put multiple websites on a single server with a single IP address Huh? This isn't true. A webserver can just look at the host header in a HTTP request and return a response for the appropriate domain.
gcoda 9y ago
Ajax without JavaScript. Ability to send a response from server updating only part of DOM. Basically, react with virtual DOM on the server pushing diffs to user with http2 awesomness. There will be no need for JS on most sites, can be adapted to current frameworks, and with preload/prefetch it might be very fast. * U can prefetch progress bar / loading state for example, and redirect to partial url of a real content
- Untit1ed 9y ago
  That sounds awesome, but how could you do it without either: - Client sends the entirety of what it has to the server so the server can do the diff - Server sends the entirety of the new page to the client so it can do the diff - Server is constantly keeping track of the last thing that the user looked at so it can send the diff for the next page ?
  - gcoda 9y ago
    Assuming: 1. Everything user sees is from server 2. Templates/Views is function of state Server can generate UI with baked changes to state. URL parameters. Generate html from received state by calling render function of clicked component and send just that components html. If we had http header for that we can leverage http2 push and replace even components which state were changed as side effect. React-Redux, Elm, Vuex doing this already. Just bake actions to urls and keep store on server.
- jlaporte 9y ago
  You may be interested in intercooler.js (http://intercoolerjs.org/ http://intercoolerjs.org/). It allows you to perform a host of AJAX + DOM manipulation flows using only HTML attributes. intercooler also supports something similar to the server pushed DOM diff flow you envision: Server Sent Events BETA (http://intercoolerjs.org/docs.html#sse http://intercoolerjs.org/docs.html#sse) "Server Sent Events are an HTML5 technology allowing for a server to push content to an HTML client. They are simpler than WebSockets but are unidirectional, allowing a server to send push content to a browser only." http://intercoolerjs.org/docs.html#sse http://intercoolerjs.org/docs.html#sse
scottmsul 9y ago
This is a moonshot, but I would love to see a social network based on protocols similar to how emails work. Then different websites could implement interfaces for the protocol and talk to each other.
martin-adams 9y ago
For me it would be the cookie consent control to be implemented at the browser level with sites being able to describe the policiy via a hosted policy file.
_greim_ 9y ago
Only half joking. Team up and find a way to force Apple to allow competing rendering engines on iOS.
c-smile 9y ago
Adding support of Internet Message Body Format (a.k.a. MIME) to browsers [1]. MIME is a format that can contain html/css/script/images/etc in single file (or stream). Thus the whole web application can be served as a single stream by the server. Yet emails (that are MIME files) can be opened by browsers as natively supported documents. [1] MIME : https://tools.ietf.org/html/rfc2045 https://tools.ietf.org/html/rfc2045
- spankalee 9y ago
  You might be interested in Web Packaging: https://github.com/WICG/webpackage https://github.com/WICG/webpackage
  - c-smile 9y ago
    Not clear why do we need this new format. MIME is there long ago. If you need some meta data you can simply add header section with application/json or application/manifest+json or whatever...
- tscs37 9y ago
  You mean like .mhtml in Chrome?
amluto 9y ago
First party isolation. Social media buttons and other trackers should not get a global identity for free. Explicit opt-in to store persistent state at all. An exception should be a cryptographic identity that is only revealed when you click a login button. No sound without opt-in. No big data transfers without opt-in. If a site wants to shove 10MB of crap in their article, then they should have to show a page asking permission to use data. And search engines should refuse to index anything behind a bloatwall.
- kgen 9y ago
  I like this idea, but because websites have the content, they can simply throw up a button that requests showing your identity to view the content and most people would blindly click it leading to the same situation we have now. The HTTPS push is important and works because the search engines can leverage their importance and the browsers can (effectively) scare people without any user input.
  - amluto 9y ago
    I should clarify what I mean: if you have a login page (form element of type login, perhaps), you get a real login button with trusted chrome (i.e. you can't restyle it to look like a kitten). If you push it, the website gets your TLS Channel ID or similar. This isn't a global identification -- it just lets the site match you up to the last time you went there. But the browser could give you an alternative that gives you a fresh transient identity.
  - jazoom 9y ago
    It would just be another case like the EU cookies thing. Every website would have the button and everyone would click it immediately to get rid of it. It would just be an annoyance.
    - amluto 9y ago
      If done well, the chrome would be more clever than that. There should be "log in as [username]" and "stay anonymous". Unless websites want to start validating email addresses to let you read their content, they'll have to accept "stay anonymous" because it would be indistinguishable on the server's end from getting a brand-new user. So you'd have an idiotic banner pissing off your users and the considerable majority would click "stay anonymous", gaining the site operator nothing.
modeless 9y ago
FIDO U2F hardware authentication token for 2 factor login. Simultaneously easier and more secure than other 2 factor methods. But first someone needs to make a <$5 hardware token so people might actually consider buying one.
- _asummers 9y ago
  YubiKeys are $18. Not $5 but that's in the neighborhood, and they're relatively new. Prices will come down.
  - modeless 9y ago
    $18 is not in the neighborhood of $5. Also I doubt the keychain type can achieve mass adoption, it's the in-USB-port kind that is actually convenient, and those cost $50.
SubiculumCode 9y ago
I'm ignorant of a lot but, segregation of cookies by browser tab. If I log into Xsocialmedia in Tab 1, and go to news site in Tab 2 using Xsocialmedia plugin, it doesn't know that tab A logged in, or that it came from same browser. Basically, I want my tabs to be isolated and treated as completely separate, isolated browsing histories, caches, and cookies. ...This is my gmail tab. All that tab ever sees is gmail. This is my HN tab. All it ever sees in HN. Like I said, this isn't my field, but..
- cstrat 9y ago
  You can kind of do this with incognito mode. It would be a bit frustrating because once you close the tabs everything is lost. However I am not sure how different browsers "incognito mode" handle multiple tabs. I do like your idea though.
  - mintplant 9y ago
    Firefox has an experimental (opt-in) feature called "Containers" for this: https://testpilot.firefox.com/experiments/containers https://testpilot.firefox.com/experiments/containers You can create a container for each compartmentalized context (work, social media, whatever) and then create tabs assigned to diffent containers. They're visually distinguished as to which tab is "in" which container, but otherwise you can manipulate and mingle them freely with the rest of your tabs. Each container's persistent state is isolated from both the other containers and your default browsing context.
    - cstrat 9y ago
      oh wow that is awesome. I've not used firefox in years but something like that could be reason enough to give it another try.
  - thephyber 9y ago
    As a UI dev working in security, I can tell you that other security devs largely don't know what Incognito mode is or how the cookies are sandboxed inside/outside of Incognito mode. Some think cookies are segregated in each Incognito tab/window. Some don't know that the Incognito cookiejar is reused if you open another Incognito tab/window without first closing all other Incognito windows+tabs. This applies to LocalStorage as well.
chriswarbo 9y ago
Make the Web standards more fundamental, so they barely need to change. Implement the rest in terms of those fundamentals. Some thoughts: - HTML and CSS are reasonable from an implementation standpoint: they have pretty rigid syntax (annotated tree of text, groups of name/value pairs) so user agents can ignore whatever they don't know/care about, and give reasonable results. Even if that's just a wall of plain text. - Javascript is awful in this regard. It has masses of syntax, keeps changing, requires incredibly specific behaviour from a truckload of APIs and likes to silently bail out completely if one thing goes wrong. Our notions of computation don't change all that much, and certainly not quickly. There's no reason to make every user agent understand all of the human-friendly bells and whistles that the standards bodies keep bolting on. Whilst "view source" is nice, these days we often need tools to undo minification and obfuscation; let alone the rise in compile-to-JS languages. The standards should only dictate something that won't need to be changed for a long time; say, a pure, untyped, call-by-value lambda calculus, with literals for integers, strings and symbols. APIs can be defined as reduction rules involving the symbols; for example: - Applications of the form '((+ x) y)', when x and y are integers, can be replaced by the sum of x and y. - Applications of the form '(array 0)', can be replaced by an empty array value (defined elsewhere); applications of the form '((array 1) x)' can be replaced by an array value containing the single element x, etc. - Applications of the form '((object 1) (keyvalue x y))' can be replaced by an object value, with the value y for property x, etc. - Application of the form '(XMLHTTPRequest x)' where x is an object value with properties... Executing such programs would, like with HTML and CSS, allow implementations to ignore whatever they don't know/care about. Expressions with no corresponding reduction rule just sit there unevaluated, whilst everything around them carries on as normal. Users could implement their own overrides for how things should rewrite; like user styles, but more pervasive. Sites could supply pure reduction rules as part of their code, to enable things like fancy control flow. Effectful reduction rules could be controlled at a fine-grained level by the user agent (and hence, the user). Programmers can write in whatever language they like and compile to this simple Web language. Since we're being ambitious, let's say they'll include links to the original source, under the AGPL ;) Fancy, state-of-the-art browsers can come with a bunch of optimisations and tricks for faster parsing and evaluation of common code patterns. They can also define their own libraries of symbols and rules, which are more amenable to optimisation (like asm.js); along with fallback "polyfills" which make them work (slowly) everywhere else. We can probably do similar things for rendering, layout, etc. The clever, complicated algorithms dictated by the standards can be great when we've got a bunch of content and we'd like the user agent to display it in a reasonable way. On the other hand, if we've got some exact output in mind, we should be able to describe it directly, rather than second-guessing and working around those algorithms. All of this can go into libraries, leaving the "core" alone. There's always the danger of turning the Web into the equivalent of obfuscated PostScript: a blob of software that, when executed, renders an image of the text, etc. content. However, I think that's mostly down to the choice of what APIs are included by default. If the default behaviour is similar to today's browsers: take text from the document and lay it out in a readable way; allow headers, emphasis, etc. using annotations, and so on, then I'm sure most would do that, ensuring the text and other content is easily parsed, indexed, etc.
lognasurn 9y ago
Now that adoption of HTTPS has solved all SQL injection holes, we can take steps to further modernize the Web so people can feel secure. Require Facebook login for everything. Just don't serve the content without a Facebook login. Can use DPI at the network layer to help enforce. Add phone-home features to CPUs to make them turn off 6 months after product introduction. Everyone ought to be buying a new computer every 6 months. Disallow email addresses ending in anything other than @gmail.com. Rewrite everything in a memory-safe language such as PHP. Eventually this can be enforced at the OS level.
- lerax 9y ago
  Seriously? This is absurd
- ionised 9y ago
  Kudos. You had me going for a minute.
alain_gilbert 9y ago
For me, I would go with: - Typed javascript should be built-in in browsers. (Typescript) TypeScript is great, but all the configurations and transpiling is a pain.
- c-smile 9y ago
  Why exactly typescript? Typescript should be compileable into WebAssembly bytecodes and that's it. If you want it to be transparently compileable, like foo.ts to be sent as WA bytecodes then something like mod-typescript (on the fly typescript compiler) can be designed that will send (compiled and cached) bytecodes.
- mvindahl 9y ago
  I kinda dislike dealing with the configuration too but it's there for a reason; because one size doesn't fit all. Then again, it's not a major pain point for me as long as I stick to the defaults. And deferring the transpiling to the browser won't really accomplish much, except increase load time for all users. I'm currently working on a project with ~500KLOC of typescript, and transpiling it takes about 15 seconds on my devbox. It's still a bit too slow for my taste but I don't think there is a technical quick fix for this kind of stuff, rather it's a tale about a project which started small, organically grew larger over time, and would in many ways benefit from a clearer structure with clear dependencies.
gwbas1c 9y ago
Less features... Instead, figure out how to force good usability.
flukus 9y ago
I want a meta command to enable the browsers reader mode. Then I can just render HTML and the browser can display it as the user prefers.
knocte 9y ago
HTTP2 instead of the horrid hack that are WebSockets or long polling.
anotherevan 9y ago
Civility.
zmix 9y ago
X(HT)ML
supertramp_sid 9y ago
Informing user about trackers being used on a website. (I know there are add ons available). There should be mode or something that informs user about this so that he can close the website and look for alternatives
daxfohl 9y ago
How about a warning in Chrome that says "You're about to use Chrome to visit this website, and thus send everything about yourself to Google to do whatever they want with", for all websites staring in Chrome ~67?
rdsubhas 9y ago
W3C standard for bloat-free websites, aka vendor-neutral equivalent of Google AMP and Facebook Instant Articles, to avoid further fragmenting the web. If its an open standard, mobile-view and other stuff can be progressively added to websites in a variety of ways: built-into browsers, polyfills or open source libraries, and lead to a much better web experience across devices. Aggregator startups and apps would stand to benefit a lot by this.
serial_crusher 9y ago
A secure standard for ads. Right now reputable sites are running ads from people they shouldn't trust, and getting bit in the ass by it. Popups, page takeovers, even viruses get distributed through ad networks and end up on non-malicious sites. None of that should work. Ads shouldn't be able to inject their own JavaScript into a page. There's a technical solution to that problem. Let's narrow down the scop of things an ad needs to do (display an image, maybe play sounds and videos (after user clicks on them), and send back a reasonable amount of tracking data, etc). Then let's come up with a sandboxed DSL for ad networks to specify their ads. Web sites could embed those ads inside an <ad> tag that sandboxes that content and makes sure only supported functionality is being used. Then I can turn off my ad blocker and not have to worry about all the security issues that unscrupulous ad providers bring with them today.
cody8295 9y ago
HTTPGP, forced PGP encryption between client-server. Would be pretty cool

Jtsummers 9y ago

My concept (high level) for dealing with things like server and user identities handled by key pairs: Take keybase (or its conceptual basis) and distribute it. Each domain can host its own key server. You can post proofs on other domains to link domain identities or logins. So now my phone has a key that's attached to the identity jtsummers at legoflambda.org. You have a service. I register the identity jtsummers at legoflambda.org with your service. I can log in using the key from my phone. My laptop has its own key. My yubikey stores a third key for access while I'm traveling without my laptop. Each of those I've connected via some proof mechanism to my key server so I can log into your service using any one of those keys. Google and others can also host a key server so my user at gmail.com identity can also be used or my facebook.com identity, again with multiple keys associated with them from my various devices. And possession of the private key can also be used to access the same services (perhaps paired with something like a TOTP or other shared secret if you want an extra layer of authentication). Now you want to send a message to me, you can have a service similar to what keybase offers. You send a message to any one of my public identities or keys, it gets made available to all of them. You know me here on HN, you send it to that identity. You know me by some other forum handle or by my gmail account you use those. And since my public keys are all available, you can send an encrypted message that will be available to any one of my devices (which I can re-encrypt as I add and remove devices). This also handles a lot of the problem with spam. Spammers now have to take the time to individually encrypt messages for every user. They have to publically post identities and keys so that users can authenticate them. And users can block spammers by blocking the keys associated with them and block an entire identity by blocking all the keys associated with the spamming key. You want to ensure that that email from your bank is legitimate? Your bank should have a publically visible key server that all communications from them make use of. Whether they send the message in the clear with only a signature or if they send an encrypted message to you (preferred for privacy and security anyways). This also helps with applications like signal/whatsapp which are presently tied to a single client instance. Now, I can associate my whatsapp key with multiple other keys (each on different devices, presumably). So you want to send me a whatsapp message, it can now be sent to all my devices. My phone number can still be an identity used by those services, but it's no longer the only one. This was a particularly annoying case for me as I travel internationally with a separate phone than my US phone since it's locked, I had to enable WhatsApp on my travel phone using my primary cell number for ease of friends communicating with me (I don't have to get my secondary number to all of them and remind them to switch back once I'm done). If I could have connected my secondary device to my primary one then all messages sent to my main number would have been received by both, and messages sent from either would all appear to the recipient as belonging to the same identity. ==== This is not a well structured presentation, sorry. It's more the random thoughts that have been hopping around in my head for the last couple months between other more pressing concerns.

gruez 9y ago

>The discontinuation of using SSL certificates for verification of website identities and a move to true fingerprinting ala SSH. You do realize that's trust-on-first-connect aka self signed certigicates, right? Especially with LE, thats worse in every way to the CA model. >Logins on websites with a public / private keypair ala SSH. Pretty much client certificates minus PKI.

thaumasiotes 9y ago
SSH is only trust-on-first-connect if you choose to behave that way. Whenever you connect to a new machine, it prompts you "I don't recognize this machine, and its fingerprint is XXXX. Do you trust that?" I don't see how the option to trust websites is worse than having a bunch of certificate authorities choose who I'll trust for me.
- conorgil145 9y ago
  How would you possibly know which fingerprints to trust? Also, do you honestly think there is any hope for the average user to understand what that means and know what to trust and what not to trust? IMO, that is a massive step backwards in usability, which directly impacts the overall security of a given solution. If something is not usable, then people will figure out a way around it and security then goes out the window. For example, if users were responsible for knowing which fingerprints to trust for a given website, they would most likely just click "ok, trust it" for everything. Then, you're overall security goes way down because now people are conditioned to click "accept" to everything, regardless of the impact.
  - dredmorbius 9y ago
    Signed archives of trusted or untrusted fingerprints, distributed by various and independent authorities is one option. Trust is, by definition, an extention of solidity or support. CA is a trust model, which has proved both brittle and unworkable. http://www.etymonline.com/index.php?term=trust&allowed_in_frame=0 http://www.etymonline.com/index.php?term=trust&allowed_in_fr... Google and other services presently provide extended trust and validity assessments for websites: pinned certificates, malware scans, and the like. A limited number of such reliable schemes would scale reasonably well, and should prove useful. I'm not saying "perfect", I'm saying "useful".
    - topranks 9y ago
      DANE perhaps? http://www.internetsociety.org/deploy360/resources/dane/ http://www.internetsociety.org/deploy360/resources/dane/
      - dredmorbius 9y ago
        Interesting, that's a possibility. I was thinking of something more akin to, say Google's pinned certificates (something which practices such as Let's Encrypt actually makes harder AFAICT): https://security.stackexchange.com/questions/29988/what-is-certificate-pinning#29990 https://security.stackexchange.com/questions/29988/what-is-c... Or something that might be a parallel of email reputation services -- SenderBase / IronPort (now Cisco) rating email servers by their spam loads, etc. Rather than negative reputation, a positive reputation (vouch rather than warn) might be viable. (Negative ratings systems, digital or otherwise, tend to inspire various legal assaults.)
- bnjemian 9y ago
  As an individual user, you have no better information than your knowledge of the website and its claims on security, maybe its brand, and what your social circles claim about its security practices. A certificate authority at least has the potential to aggregate data and from there assess the security of a website. The original ideas behind certificate authorities are not dissimilar from insurance.

antjanus 9y ago

SSH-style login is still something I'd really fucking love. Much more secure way of logging in, easy protocol for storing multiple passwords, and easy authorization/deauthirzation of passwords/keys.

StavrosK 9y ago
Client TLS certs already exist, and they are a massive pain for the average user.
- vacri 9y ago
  I remember StartCom used client TLS certs, the only place where I ever saw them in use, and the browser workflow was certainly clunky. I'd hate to see a non-techie have to deal with it.
  - BenjiWiebe 9y ago
    They worked quite smoothly for me. I actually liked StartCom's login process.
- adrianratnapala 9y ago
  So I have heard of client TLS authentication, but does it exist for the web (I mean just in principle, not whether it is really used). That is, do browsers support it? The thing is, if it is a massive pain for average users, then that is an own-goal. Look at SSH: there is no certification chain there. All you do is generate a keypair and then (here's the awkward bit) magic the pubkey over to the server. It would be easy enough for a website to make pubkey installation a seamless part of the sign-on workflow.
  - tptacek 9y ago
    Yes, browsers have supported client certificates for decades and continue to today.
  - fragmede 9y ago
    It is a massive pain for average users but it's well supported by browsers is because big corporations have IT departments that provision (and admin) computers for their users, average or otherwise, and the provisioning process includes setting up client certs. So while browsers do support client certs, there has been very little effort to make them easy to install due to a chicken-egg situation. They're hard to use, so no one uses them, but no one (random sites on the Internet, that is) uses them for client auth because they're hard to use.
Sjoerd 9y ago
Token binding provides something like that. With token binding you have a private/public key pair for each site that supports it. An identifier is created from the public key and signed with the private key, to prove your identity. https://www.sjoerdlangkemper.nl/2017/07/05/prevent-session-hijacking-with-token-binding/ https://www.sjoerdlangkemper.nl/2017/07/05/prevent-session-h...

kerkeslager 9y ago

I think the only way this can happen is zero-knowledge password proofs, i.e. browsers implement a mechanism by which password fields submit a proof that the user has the password, rather than submitting the password. This way the server can only verify the password if they've implemented the proof system correctly, and they can't leak the password because they've never had it. The basic idea is, the server gives a unique nonce with the password form. The user enters their password. On form submit, the browser stretches the key space of the password using a slow hash, then uses the digest to generate an asymmetric key via a referentially transparent algorithm (no random salts). Then the browser prepends the URL (obtained from HTTPS) to the given nonce (to prevent man in the middle attacks). The browser then checks to see if it has seen this nonce before and displays an error if it has (to prevent replay attacks--this forces servers to generate new nonces, although the browser can't force them to verify that the nonce that is signed later is the same one they sent). Finally the browser uses the key to sign the nonce, and sends the signature to the server. The server uses the public key (which was generated in the same way and given to the server at sign-up) to verify that the user has the password.

joegosse 9y ago
I love the idea of zero-knowledge password proofs. Others can chime in on the approach you've proposed, but I have a more practical concern about developing critical mass. How do you break through the chicken and egg problem of not enough users using or not enough browsers supporting this capability?
- dredmorbius 9y ago
  Find a large user who feels this is a valuable feature and have them adopt it. Governments are one such large customer. Vendors, faced with multiple customers requesting a feature, but with slightly varying specifications, will tend to seek a mutually acceptable spec.
- kerkeslager 9y ago
  If it's a field on inputs of type password, all you'd get is something like: <input type='password' password-nonce='42'></input> Browsers that support the password-nonce argument sign as I described. Browsers that don't support it pass through the password and the server performs the ZKPP key generation (this is no worse than the current system of hashing passwords). So servers can implement this immediately without worrying about breaking in non-supporting browsers. After adoption by a few major sites, browsers can add a warning that the server didn't send a password nonce and the password will be passed to the server so the user has to click "Okay" before it gets submitted. This can be escalated to more severe messages to pressure more sites to comply.
seangrogg 9y ago
I'm waiting for other people to tell you to implement this, but without JavaScript.
- kerkeslager 9y ago
  Implementing it in Javascript would defeat the entire purpose. The point is for the browser to implement it as a supported field on input tags of type password.