4 ms·

The key thing to realize here is that the browser is the "user agent": it is supposed to represent the interests of the user. Now users have pretty diverse int

The key thing to realize here is that the browser is the "user agent": it is supposed to represent the interests of the user. Now users have pretty diverse interests, so browsers don't always get this entirely right, which is one reason it's important to have a variety of browsers so users can pick one that does represent their interests. What's happening in this case is that the site is doing something that pretty much everyone who understands the issue agrees is harmful to users: having them type their password into an insecure page. Browsers and security professionals spent 10+ years trying to convince web sites to stop doing that. Then browsers spent a few years telling websites that they will start warning users about this behavior and giving specific timelines for when this would happen. Then they started showing those warnings they promised they would show. To go back to your analogy, it's as if Microsoft had told developers for a long time that some specific API is deprecated due to being "insecure". Then they gave a timeline for the API being removed. Then they removed it. Can there still be applications who didn't move away from that API? Sure. Is it entirely Microsoft's fault that they are now getting lots of support calls? That's a hard case to make. Note that this sort of deprecation is something that Microsoft and Apple have in fact done. > The only way they get away with it is because they have the biggest market share. Firefox is showing the same warnings, no? > businesses would simply shut off access to Chrome browsers and tell them their browsers were faulty Sure, just like in the Microsoft case businesses tell their users to not install the OS security update, etc. You're right that if Chrome and Firefox had smaller marketshare businesses _could_ threaten to do this or actually do this. But at that point it's not entirely clear who the real "bully" is... In either case there's an exercise of market power to get your way against the (possibly reasonable) objections of others. Disclaimer: I work for Mozilla, on Firefox.

peterwwillis 9y ago
> the browser is the "user agent": it is supposed to represent the interests of the user > it's important to have a variety of browsers so users can pick one that does represent their interests First of all, I'm now terrified of Mozilla/Firefox, because this comment reflects the idea that browsers should be developed as independent ethical entities that represent different groups, in the way special interest groups lobby on behalf of specific people, ignoring the concerns of everyone else. Second, it's dangerous to put the onus of security on everyone but the user. I'm sure you've seen the wall of sheep: it's more than just http passwords. Users are stupid, and they get security wrong, and they need to be helped to get it right. But one thing that won't help them is absolving them of any thought whatsoever into investing in their own security. Where this will end is a marketing campaign that sounds a lot like "Mozilla Firefox: The Secure Browser". All they need to do is download your program and just assume everything is fine. Which will of course be a lie, but one that everyone will accept, because they want it to be true. The browser should not become a political toy. It should be simply a tool, and it should be up to those who wield that tool to decide how it is used. If I make an axe, I don't come to your farm and tell you how to swing it. This could have been trivially handled by simply asking users how much concern they want to have over their security, or providing some mechanism for organizations to easily transition into technology changes at a pace that works for them. Instead it seems like browser makers are too fond of themselves as white knights to provide reasonable compromises. Browsers are completely at fault for handling security so poorly in the first place. They continue to have the most asinine user experiences in the world when it comes to understanding what is actually going on when a user browses the web. They continue to support standards which can be easily subverted. They continue to build hack after hack into something that was supposed to just navigate documents and is now an entire fucking application platform. Browsers are a mess, and it's their designers that are at fault for that mess. Now it's clear that a mentality of moral superiority and special interests is the cause. And while I'm ranting, what is wrong with browsers that they can't simply build a working secure authentication framework into the protocol and back it with a halfway usable UI? How is it a 20 year old tool used to access backend servers has a more effective authentication and authorization system than the most commonly used program in the entire world? It's not like this stuff was some mystery that the poor lowly browser devs couldn't understand. We don't need to be relying on shitty web forms to send plaintext passwords - we didn't need to be doing that in the year 2000!!!! How the hell is it that this piece of software, which is somehow more complex than my entire operating system, can't seem to perform the basic functions i've been doing with other programs for half my life? And yet have the balls to claim they're working in service to the user? You know what would have been great for the users? A secure protocol which didn't degrade its own security. A URI convention that refuses to communicate with insecure sites. A button that rejects all connections not destined for the domain in the address bar, and functions that control the browser or access to its data without the user expressly allowing it. Simple things that could have actually completely ensured users' safety, without ridiculous complicated kludges that only do half of what they're supposed to do. And these should not be considered controversial - it's not like I'm suggesting they implement security policies before they add buggy features to brand new releases. You are right, though. Browsers did take 10+ years to enforce a policy that is as unnecessary as it is sudden. I'm sure users will thank the browser vendors now for how much safer they are from black hat hackers in coffee shops. Oh, wait - they are still insecure. It's just now they know it and are unhappy about it, and other organizations can now capitalize on this.
- bzbarsky 9y ago
  > because this comment reflects the idea that browsers should be developed as independent ethical entities that represent different groups I'm not sure where "ethical" came into that. Some users want to have features that allow them to read websites in their preferred fonts. Other users don't care about fonts, but _really_ care about the colors and want high contrast. Still others want to have strong privacy safeguards (think Tor), while a fourth set care about privacy a bit less than that, and a fifth set don't care about privacy at all. These diverse needs might best be served by multiple different browsers that focus on different aspects of the user experience. I see no reason why a browser that explicitly tries to make the web more usable for people who are red/green colorblind, say, should be a problem, though it seems to me that you do.... > it's dangerous to put the onus of security on everyone but the user No one is suggesting that. However the reality is that there are maybe at most double-digit numbers of different browsers, maybe hundreds of millions of websites, if you're very generous, and billions of users. You ideally want to enforce security at chokepoints, which is why the browsers do most of the lifting here, then websites, then users. There have been tons of user education campaigns in the history of the internet. To some extent they've even worked. > The browser should not become a political toy. It should be simply a tool Sure, and no one suggested it should be a "political toy". But maybe one user wants a flathead screwdriver and another wants a phillips head. And a third one wants a hammer, or hex wrench. > This could have been trivially handled by simply asking users how much concern they want to have over their security Been done, via surveys. The answer is "a lot". And yes, we could just say that if they care then they should be constantly vigilant. But constant vigilance is something people are really bad at (on a hardware level!), compared to computers. So any time we can design systems that don't require constant vigilance from people we probably should. I would go so far as to claim that requiring constant vigilance from people when we don't have to, and then blaming or punishing them when they cannot comply, is simply unethical. > or providing some mechanism for organizations to easily transition into technology changes at a pace that works for them This is why browsers have been cooperating at creating things like Lets Encrypt, precisely to provide such a mechanism. The question of timeframes is a complicated one, of course. > Browsers are completely at fault for handling security so poorly in the first place. No argument there. This is something browsers have been trying to do better. > Now it's clear that a mentality of moral superiority and special interests is the cause. I think you're reading things into what I said that were simply not there.

peterwwillis 9y ago

> the browser is the "user agent": it is supposed to represent the interests of the user > it's important to have a variety of browsers so users can pick one that does represent their interests First of all, I'm now terrified of Mozilla/Firefox, because this comment reflects the idea that browsers should be developed as independent ethical entities that represent different groups, in the way special interest groups lobby on behalf of specific people, ignoring the concerns of everyone else. Second, it's dangerous to put the onus of security on everyone but the user. I'm sure you've seen the wall of sheep: it's more than just http passwords. Users are stupid, and they get security wrong, and they need to be helped to get it right. But one thing that won't help them is absolving them of any thought whatsoever into investing in their own security. Where this will end is a marketing campaign that sounds a lot like "Mozilla Firefox: The Secure Browser". All they need to do is download your program and just assume everything is fine. Which will of course be a lie, but one that everyone will accept, because they want it to be true. The browser should not become a political toy. It should be simply a tool, and it should be up to those who wield that tool to decide how it is used. If I make an axe, I don't come to your farm and tell you how to swing it. This could have been trivially handled by simply asking users how much concern they want to have over their security, or providing some mechanism for organizations to easily transition into technology changes at a pace that works for them. Instead it seems like browser makers are too fond of themselves as white knights to provide reasonable compromises. Browsers are completely at fault for handling security so poorly in the first place. They continue to have the most asinine user experiences in the world when it comes to understanding what is actually going on when a user browses the web. They continue to support standards which can be easily subverted. They continue to build hack after hack into something that was supposed to just navigate documents and is now an entire fucking application platform. Browsers are a mess, and it's their designers that are at fault for that mess. Now it's clear that a mentality of moral superiority and special interests is the cause. And while I'm ranting, what is wrong with browsers that they can't simply build a working secure authentication framework into the protocol and back it with a halfway usable UI? How is it a 20 year old tool used to access backend servers has a more effective authentication and authorization system than the most commonly used program in the entire world? It's not like this stuff was some mystery that the poor lowly browser devs couldn't understand. We don't need to be relying on shitty web forms to send plaintext passwords - we didn't need to be doing that in the year 2000!!!! How the hell is it that this piece of software, which is somehow more complex than my entire operating system, can't seem to perform the basic functions i've been doing with other programs for half my life? And yet have the balls to claim they're working in service to the user? You know what would have been great for the users? A secure protocol which didn't degrade its own security. A URI convention that refuses to communicate with insecure sites. A button that rejects all connections not destined for the domain in the address bar, and functions that control the browser or access to its data without the user expressly allowing it. Simple things that could have actually completely ensured users' safety, without ridiculous complicated kludges that only do half of what they're supposed to do. And these should not be considered controversial - it's not like I'm suggesting they implement security policies before they add buggy features to brand new releases. You are right, though. Browsers did take 10+ years to enforce a policy that is as unnecessary as it is sudden. I'm sure users will thank the browser vendors now for how much safer they are from black hat hackers in coffee shops. Oh, wait - they are still insecure. It's just now they know it and are unhappy about it, and other organizations can now capitalize on this.

bzbarsky 9y ago
> because this comment reflects the idea that browsers should be developed as independent ethical entities that represent different groups I'm not sure where "ethical" came into that. Some users want to have features that allow them to read websites in their preferred fonts. Other users don't care about fonts, but _really_ care about the colors and want high contrast. Still others want to have strong privacy safeguards (think Tor), while a fourth set care about privacy a bit less than that, and a fifth set don't care about privacy at all. These diverse needs might best be served by multiple different browsers that focus on different aspects of the user experience. I see no reason why a browser that explicitly tries to make the web more usable for people who are red/green colorblind, say, should be a problem, though it seems to me that you do.... > it's dangerous to put the onus of security on everyone but the user No one is suggesting that. However the reality is that there are maybe at most double-digit numbers of different browsers, maybe hundreds of millions of websites, if you're very generous, and billions of users. You ideally want to enforce security at chokepoints, which is why the browsers do most of the lifting here, then websites, then users. There have been tons of user education campaigns in the history of the internet. To some extent they've even worked. > The browser should not become a political toy. It should be simply a tool Sure, and no one suggested it should be a "political toy". But maybe one user wants a flathead screwdriver and another wants a phillips head. And a third one wants a hammer, or hex wrench. > This could have been trivially handled by simply asking users how much concern they want to have over their security Been done, via surveys. The answer is "a lot". And yes, we could just say that if they care then they should be constantly vigilant. But constant vigilance is something people are really bad at (on a hardware level!), compared to computers. So any time we can design systems that don't require constant vigilance from people we probably should. I would go so far as to claim that requiring constant vigilance from people when we don't have to, and then blaming or punishing them when they cannot comply, is simply unethical. > or providing some mechanism for organizations to easily transition into technology changes at a pace that works for them This is why browsers have been cooperating at creating things like Lets Encrypt, precisely to provide such a mechanism. The question of timeframes is a complicated one, of course. > Browsers are completely at fault for handling security so poorly in the first place. No argument there. This is something browsers have been trying to do better. > Now it's clear that a mentality of moral superiority and special interests is the cause. I think you're reading things into what I said that were simply not there.