Live data from Hacker News

Ask HN: What feature would you want the web to “force” next, after HTTPS?

news.ycombinator.com

41–50 of 279 posts

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#41
Dear overlord, stop this shit. Don't force any web user over your agenda BS.

Amazon.com worked fine from 1995 to 2016 with HTTP (only the login page was HTTPS).

If you have a crappy ISP like Verizon or whatever, it's your own personal problem - 99% of the web user don't care about your problem. Maybe use a VPN to somewhere to an ISP you can trust.

I stopped using Firefox because they turned mad. Chromium with some custom patches seems like a far better solution nowadays. Yet I see Google is too trying to destroy the open web with their PWA/AMP monoculture that is favored and listed on top of search results.

We need the EFF and other "good" foundations to lobby for the end user - too many shady and corporate entities lobby against the end user, unfortunately.

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#45

A truly obfuscatory browser: one in which everything sent to the server looked the same, regardless of which user, region, etc.

curl -H "" -o stuff.html && elinks stuff.html

I've been looking for a site I can run this on over TOR at random times for reading news but I haven't found one.

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#46

- A protocol for sites to get my public PGP key for server side use - The discontinuation of using SSL certificates for verification of website identities and a move to true fingerprinting ala SSH. - Deprecation of email or rather its insecurity. - Logins on websites with a public / private keypair ala SSH. - A resurgence in sites that let me pick my own anonymous username instead of Facebook, Google or Twitter login…

The login problem was attempted to be solved by Mozilla's "persona", now deprecated. I like the general idea that I strongly authenticate to my browser, which can then "vouch" for me to various sites using cryptographic tokens that are otherwise useless (so no cracking/stealing passwords, etc). The devil of course would be in the details.

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#48
post #30

- A protocol for sites to get my public PGP key for server side use - The discontinuation of using SSL certificates for verification of website identities and a move to true fingerprinting ala SSH. - Deprecation of email or rather its insecurity. - Logins on websites with a public / private keypair ala SSH. - A resurgence in sites that let me pick my own anonymous username instead of Facebook, Google or Twitter login…

> Deprecation of email or rather its insecurity. We would need something to replace it with, there is really nothing right now.

While I agree, there is definitely movement and recent movement [0][1] , I just wish I had the knowledge to contribute. I am great and figuring out how things work, breaking them and understanding them. Building from scratch is a bit above my head, albeit I have a few ideas....

[0] https://news.ycombinator.com/item?id=14708783 [1] https://magmadaemon.org/

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#49
post #34
post #5

I'd vote for DNS-over-HTTPS or similar tech. Encrypting domain name resolution should help mitigate a gateway or proxy (Comcast) from knowing or blocking sites you visit.

Doesn't https://dnscrypt.org do that?

Nope, it simply gives you an assurance that the DNS entry you receive hasn't been spoofed and is coming from the DNS server that you expect it to originate from. See their homepage explanation.

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#50

- A protocol for sites to get my public PGP key for server side use - The discontinuation of using SSL certificates for verification of website identities and a move to true fingerprinting ala SSH. - Deprecation of email or rather its insecurity. - Logins on websites with a public / private keypair ala SSH. - A resurgence in sites that let me pick my own anonymous username instead of Facebook, Google or Twitter login…

My concept (high level) for dealing with things like server and user identities handled by key pairs:

Take keybase (or its conceptual basis) and distribute it. Each domain can host its own key server. You can post proofs on other domains to link domain identities or logins. So now my phone has a key that's attached to the identity jtsummers at legoflambda.org. You have a service. I register the identity jtsummers at legoflambda.org with your service. I can log in using the key from my phone. My laptop has its own key. My yubikey stores a third key for access while I'm traveling without my laptop. Each of those I've connected via some proof mechanism to my key server so I can log into your service using any one of those keys.

Google and others can also host a key server so my user at gmail.com identity can also be used or my facebook.com identity, again with multiple keys associated with them from my various devices. And possession of the private key can also be used to access the same services (perhaps paired with something like a TOTP or other shared secret if you want an extra layer of authentication).

Now you want to send a message to me, you can have a service similar to what keybase offers. You send a message to any one of my public identities or keys, it gets made available to all of them. You know me here on HN, you send it to that identity. You know me by some other forum handle or by my gmail account you use those. And since my public keys are all available, you can send an encrypted message that will be available to any one of my devices (which I can re-encrypt as I add and remove devices).

This also handles a lot of the problem with spam. Spammers now have to take the time to individually encrypt messages for every user. They have to publically post identities and keys so that users can authenticate them. And users can block spammers by blocking the keys associated with them and block an entire identity by blocking all the keys associated with the spamming key. You want to ensure that that email from your bank is legitimate? Your bank should have a publically visible key server that all communications from them make use of. Whether they send the message in the clear with only a signature or if they send an encrypted message to you (preferred for privacy and security anyways).

This also helps with applications like signal/whatsapp which are presently tied to a single client instance. Now, I can associate my whatsapp key with multiple other keys (each on different devices, presumably). So you want to send me a whatsapp message, it can now be sent to all my devices. My phone number can still be an identity used by those services, but it's no longer the only one.

This was a particularly annoying case for me as I travel internationally with a separate phone than my US phone since it's locked, I had to enable WhatsApp on my travel phone using my primary cell number for ease of friends communicating with me (I don't have to get my secondary number to all of them and remind them to switch back once I'm done). If I could have connected my secondary device to my primary one then all messages sent to my main number would have been received by both, and messages sent from either would all appear to the recipient as belonging to the same identity.

====

This is not a well structured presentation, sorry. It's more the random thoughts that have been hopping around in my head for the last couple months between other more pressing concerns.

Post reply on HN