TLS is now pervasive. Certificate Transparency prevents CAs from aiding interception. http is now explicitly flagged as "insecure". Browser vendors have had a m

TLS is now pervasive. Certificate Transparency prevents CAs from aiding interception. http is now explicitly flagged as "insecure". Browser vendors have had a major part in those improvements to Internet security. (So have many other parties, such as Let's Encrypt for removing cost as an excuse for not using TLS.) People trying to make protocols more secure don't need to convince you, they just need to make your job as hard as possible until most users reject what you're offering. We need a dozen more ideas like Certificate Transparency. We need pervasive end-to-end DNS security, with unencrypted DNS flagged as insecure. We need a means of preventing DNS servers from altering the DNS records of sites they aren't authoritative for. We need browsers to all agree to explicitly flag connections as insecure when they chain to a locally installed certificate, in a way that can't be hidden without rebuilding from source. And this isn't a purely technical problem, either. We also need legal support to review regulations in certain regulated industries and demonstrate well-supported ways to fulfill those regulations without breaking security (e.g. "if you do XYZ to log the time and endpoints of connections but don't actually MITM their traffic, it's reasonably well-established that you're fulfilling ABC regulation"). We need lobbyists to change regulations incompatible with secure protocols. We need designers to make security as usable as possible, because poor usability is a security problem.