3 ms·
I know nobody likes this idea, but I believe the best solution is a curated list of companies, products, and their websites. You provide a browser add-on that d
by throwaway984393 5y ago
I know nobody likes this idea, but I believe the best solution is a curated list of companies, products, and their websites. You provide a browser add-on that displays the list, and let users search through it and click on the company/product they want.
Here's some ways to implement this:
1. Have CAs publish a list of domains and company names. This is problematic because lots of companies have different domains and legal entities, and it's very likely an attacker could list a company that sounds like another company with a malware domain.
2. Volunteers register companies and their domains and brand logos in a Git repo and companies can request changes if need be. They'll be explicitly only trying to list domains that people have asked for and scrutinize them to prevent adding phishing sites.
The latter would have some problems I'm sure, but it gets closest to what users want, which is "show me Bank websites" / "show me Bank of America's website". By having a curated list and some strict policies on managing the list, it will probably be much safer and easier than any other method that exists today to find a company website. Additional techniques could add integrity, like a reporting mechanism, and a star feature to favorite specific sites so they come up first with the number of times they've been starred.
- raxxorrax 5y agoWe can create a toddler net and for some applications that would provide benefits. It could use the same infrastructure as the common net and can leave it completely unaffected. You would just need specialized web clients.
- throwaway984393 5y agoWhy would you need specialized clients?
- renewiltord 5y agoSo that those who want toddlernet won’t be exposed to the rest of the Internet. Their clients will only display todsites.
- throwaway984393 5y agoA browser add-on could do that with no other modification to the 'client' browser (if that's what the user wanted, but that's not what I'm suggesting)
- mnw21cam 5y agoThere are several problems with this idea. The first is that of scale - the list of companies along with their associated products and proven-correct official web site(s) would be a nightmare to maintain. I would not trust it to be accurate just because of the scale. One possible solution would be for the company registration with government to include a list of web sites, but then you have the problem of merging company registers from multiple countries, and trusting government. Secondly, allowing volunteers to provide updates to this list allows an attack vector. Thirdly, it is trying to solve a problem that doesn't exist. It's still best and simplest for a certificate to be tied to a domain, not a company. The last several years has shown that attaching a certificate to a company is ignored by users and doesn't add any security. Attaching a certificate to a domain is something that can be done with a high level of security and assurance, but attaching it to a company (or product) cannot be as securely done, and is information that is less useful.
- feanaro 5y agoThis sounds like you're giving preferential treatment to companies over non-companies. Why would companies get preferential treatment on the internet? I don't think that's a good idea.