4 ms·

We might even call it "favicon", for the fun of it… :-)

kba 8y ago
Any fake-Facebook website can copy Facebook's favicon, so that wouldn't add any security at all. An identicon is a hash value represented as an icon. "facebook.com", for instance, may hash to a red image with a yellow line through it. While you wouldn't remember the icon initially, over time you would – or at least your subconsious would. If you ever visisted a fake-Facebook, you'd immediately notice that something was wrong if the icon suddenly was green with a blue dot in it, for instance.
- amygdyl 8y ago
  deliver the Favicon from a USPTO server, and I think you should nail the most amazing proportion of fraudsters, overnight.
mrec 8y ago
Not sure if serious, but no. Anyone can copy a favicon; the point of an identicon is that it's generated from the domain name, so subverting it would require an attacker to find a hash collision with a visually similar domain.
- masswerk 8y ago
  Sorry, I mistook "that is rendered from the domain" for "rendered from a resource from the domain". However, teach users to read domain names! If users do not grasp the general concept, e.g., if the supposed identity is just "example" (possibly with some decoration considered insignificant) and not "example.com", how are they supposed to survive? Domains have been around for more than a quarter of a century, the Internet is actually part of our lives… There is no excuse, and there is no sense in pretending that there was no harm in not understanding the basics. That said, there are real ambiguities that have to be addressed.
  - pvorb 8y ago
    Yes, it would be nice if every child would learn these basics in school.
    - eecc 8y ago
      Yes, learning to be good consumers is way more important than basic skills such as maths, reading, writing and general critical thinking /s
      - krotton 8y ago
        We do teach kids not to talk to strangers in the street and consider it quite important, I think. What's so much different about teaching them how not to get robbed on-line? It's not about being a good consumer, but about minding your own feet.
    - amygdyl 8y ago
      I am expanding the idea that I posited above, to use the USPTO, for one canonical answer for every query concerning the identity of business services on the Internet... This involves providing both clear identity confirmation and the Favicon, to the browser, from USPTO managed servers, to visually green light to the user, the correct online correspondent. Schools are a excellent arbiter of the quality and integrity of known correspondents online. Nota bene, I say known correspondents, I am limiting this idea to whitelist sites and services only. Color borders surrounding each Favicon, can briefly flash. I want as a parent, to need only glance at the top left corner of the browser that my son is using. Kids don't want my criticism of what they find a engaging experience. My colleagues don't want my analytical views of their Economist newspaper reading, for that matter...But I think it would be great to see really one look response to a parent's concern. This animation can be enlivened by a cursor across the toolbar or similar gesture. "No worries, dad" is a great positive action to encourage. Because it's not about censorship, it's about learning what authenticity is. I imagine a nice modern pulsating heartbeat that's restful, for a positive identification of a trusted correspondent, and a fluttering and increasingly flashy, insistent nagging for a warning. I will add to my wishlist, the ability to sign a local whitelist sites database, complete with ticketing system, to which the kids are able to submit the arguments for, for example, sites and blogs that are not within the penumbral enclave of this identity umbrella.
- amygdyl 8y ago
  if you could identify the site as a trademark holders place of business, surely, the Favicon could be stored encrypted as SVG with the browser application distribution?
- wstuartcl 8y ago
  Yeah, cause moving from a text domain with no collision possible to some sort of collision prone visual system to ensure are able to understand the domain they are viewing seems like a great idea. FFS, if users cant see that somedomainname.com is different than somedomanname.com how does a randomized image of the domain name based on a hash solve this.
  - mrec 8y ago
    I'm not saying it's a good idea. I don't think it is. But it's not just a favicon.

kba 8y ago

Any fake-Facebook website can copy Facebook's favicon, so that wouldn't add any security at all. An identicon is a hash value represented as an icon. "facebook.com", for instance, may hash to a red image with a yellow line through it. While you wouldn't remember the icon initially, over time you would – or at least your subconsious would. If you ever visisted a fake-Facebook, you'd immediately notice that something was wrong if the icon suddenly was green with a blue dot in it, for instance.

amygdyl 8y ago
deliver the Favicon from a USPTO server, and I think you should nail the most amazing proportion of fraudsters, overnight.

mrec 8y ago

Not sure if serious, but no. Anyone can copy a favicon; the point of an identicon is that it's generated from the domain name, so subverting it would require an attacker to find a hash collision with a visually similar domain.

masswerk 8y ago
Sorry, I mistook "that is rendered from the domain" for "rendered from a resource from the domain". However, teach users to read domain names! If users do not grasp the general concept, e.g., if the supposed identity is just "example" (possibly with some decoration considered insignificant) and not "example.com", how are they supposed to survive? Domains have been around for more than a quarter of a century, the Internet is actually part of our lives… There is no excuse, and there is no sense in pretending that there was no harm in not understanding the basics. That said, there are real ambiguities that have to be addressed.
- pvorb 8y ago
  Yes, it would be nice if every child would learn these basics in school.
  - eecc 8y ago
    Yes, learning to be good consumers is way more important than basic skills such as maths, reading, writing and general critical thinking /s
    - krotton 8y ago
      We do teach kids not to talk to strangers in the street and consider it quite important, I think. What's so much different about teaching them how not to get robbed on-line? It's not about being a good consumer, but about minding your own feet.
  - amygdyl 8y ago
    I am expanding the idea that I posited above, to use the USPTO, for one canonical answer for every query concerning the identity of business services on the Internet... This involves providing both clear identity confirmation and the Favicon, to the browser, from USPTO managed servers, to visually green light to the user, the correct online correspondent. Schools are a excellent arbiter of the quality and integrity of known correspondents online. Nota bene, I say known correspondents, I am limiting this idea to whitelist sites and services only. Color borders surrounding each Favicon, can briefly flash. I want as a parent, to need only glance at the top left corner of the browser that my son is using. Kids don't want my criticism of what they find a engaging experience. My colleagues don't want my analytical views of their Economist newspaper reading, for that matter...But I think it would be great to see really one look response to a parent's concern. This animation can be enlivened by a cursor across the toolbar or similar gesture. "No worries, dad" is a great positive action to encourage. Because it's not about censorship, it's about learning what authenticity is. I imagine a nice modern pulsating heartbeat that's restful, for a positive identification of a trusted correspondent, and a fluttering and increasingly flashy, insistent nagging for a warning. I will add to my wishlist, the ability to sign a local whitelist sites database, complete with ticketing system, to which the kids are able to submit the arguments for, for example, sites and blogs that are not within the penumbral enclave of this identity umbrella.
amygdyl 8y ago
if you could identify the site as a trademark holders place of business, surely, the Favicon could be stored encrypted as SVG with the browser application distribution?
wstuartcl 8y ago
Yeah, cause moving from a text domain with no collision possible to some sort of collision prone visual system to ensure are able to understand the domain they are viewing seems like a great idea. FFS, if users cant see that somedomainname.com is different than somedomanname.com how does a randomized image of the domain name based on a hash solve this.
- mrec 8y ago
  I'm not saying it's a good idea. I don't think it is. But it's not just a favicon.