4 ms·

In 20 years it will be impossible to manually browse to an unapproved "unsafe" URL in a general purpose browser.

by cft 6y ago

ktpsns 6y ago
Well, its hardly possible to manually browse an unapproved unsafe URL even today. Ever tried to browse a site with a self-signed certificate? In most browsers you have to do a lot of extra clicks to get in. But there will always be special purpose browsers. There is "TOR browser" today, and we will have "vintage web browsers" the same way we have CLI/TLI browsers still today (thinking of elinks and lynx), or the same way as there are still FTP clients and Gopher clients.
- im3w1l 6y ago
  iPhone doesn't allow true 3rd party browsers only reskinned Safari. Apple even removed a browser for extending safari too much [0]. So while there will be vintage web browsers, normal people may not have access to them. https://www.theverge.com/2020/10/20/21524665/stadium-stadia-browser-app-store-ios-apple-workaround-game-streaming https://www.theverge.com/2020/10/20/21524665/stadium-stadia-...
- TheCoelacanth 6y ago
  All the certificate verifies is that the server you are connected to actually belongs to someone who controls the domain that it's hosted at. You can get one issued for free just by demonstrating that you actually control the domain.
  - ktpsns 6y ago
    There is so much on TLS beyond Let's Encrypt. For instance, TLS allows user certificates to authenticate the user, not the server. This works a bit like SSH passwordless login (thanks to key authentication). This technique only works if the site operator also controls a CA which the browser accepts. Companies can easily install self-signed certs to do so, but on the wild web that's quite difficult. So yeah, even today there are use cases for custom CAs.
    - TheCoelacanth 6y ago
      I'm aware that client certificates exist. I'm not aware of anyone actually using them. It also doesn't really have the problem of "unapproved" sites. You are already installing a certificate on the client. It's no extra work to add another trusted CA at the same time.
cbozeman 6y ago
This is the real nightmare scenario...

In 20 years it will be impossible to manually browse to an unapproved "unsafe" URL in a general purpose browser.

by cft 6y ago

In 20 years it will be impossible to manually browse to an unapproved "unsafe" URL in a general purpose browser.

Well, its hardly possible to manually browse an unapproved unsafe URL even today. Ever tried to browse a site with a self-signed certificate? In most browsers you have to do a lot of extra clicks to get in. But there will always be special purpose browsers. There is "TOR browser" today, and we will have "vintage web browsers" the same way we have CLI/TLI browsers still today (thinking of elinks and lynx), or the same way as there are still FTP clients and Gopher clients.

im3w1l 6y ago
iPhone doesn't allow true 3rd party browsers only reskinned Safari. Apple even removed a browser for extending safari too much [0]. So while there will be vintage web browsers, normal people may not have access to them. https://www.theverge.com/2020/10/20/21524665/stadium-stadia-browser-app-store-ios-apple-workaround-game-streaming https://www.theverge.com/2020/10/20/21524665/stadium-stadia-...
TheCoelacanth 6y ago
All the certificate verifies is that the server you are connected to actually belongs to someone who controls the domain that it's hosted at. You can get one issued for free just by demonstrating that you actually control the domain.
- ktpsns 6y ago
  There is so much on TLS beyond Let's Encrypt. For instance, TLS allows user certificates to authenticate the user, not the server. This works a bit like SSH passwordless login (thanks to key authentication). This technique only works if the site operator also controls a CA which the browser accepts. Companies can easily install self-signed certs to do so, but on the wild web that's quite difficult. So yeah, even today there are use cases for custom CAs.
  - TheCoelacanth 6y ago
    I'm aware that client certificates exist. I'm not aware of anyone actually using them. It also doesn't really have the problem of "unapproved" sites. You are already installing a certificate on the client. It's no extra work to add another trusted CA at the same time.

cbozeman 6y ago

This is the real nightmare scenario...