Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What feature would you want the web to “force” next, after HTTPS?

news.ycombinator.com

Post reply on HN
Print view View original

51–60 of 279 posts

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#51

Post by criddell »

notzorbo3 wrote: post #17

- A protocol for sites to get my public PGP key for server side use - The discontinuation of using SSL certificates for verification of website identities and a move to true fingerprinting ala SSH. - Deprecation of email or rather its insecurity. - Logins on websites with a public / private keypair ala SSH. - A resurgence in sites that let me pick my own anonymous username instead of Facebook, Google or Twitter login…

I love the encryption ideas.

Do you know if PGP public/private key pairs can be used for ephemeral keys? I'd hate to rely on the same secret to store everything throughout time.

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#52

Post by swiley »

fosco wrote: post #48
swiley wrote: post #30

Earlier quoted context omitted.

> Deprecation of email or rather its insecurity. We would need something to replace it with, there is really nothing right now.

While I agree, there is definitely movement and recent movement [0][1] , I just wish I had the knowledge to contribute. I am great and figuring out how things work, breaking them and understanding them. Building from scratch is a bit above my head, albeit I have a few ideas.... [0] https://news.ycombinator.com/item?id=14708783 [1] https://magmadaemon.org/

We already have standards for encrypting/authenticating email transfer between mail servers and between the server and user agent.

This doesn't solve the problem of mail being encrypted in transit. As far as I can tell the server operator can still read the user's mail. What we need is end-to-end encryption, lack of support in MUAs (iphone mail app, thunderbird etc.) is the problem here, it has really nothing to do with the server.

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#53

Post by monk_e_boy »

Pay turn off ads. A certain percentage of visitors are asked to rate the content (to avoid paying) the rest of the visitors are automatically billed and pay the average rating.

Each user can specify a maximum payment and can opt to view with ads if payment requested is too much.

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#54

Post by criddell »

swiley wrote: post #22
syncerr wrote: post #5

I'd vote for DNS-over-HTTPS or similar tech. Encrypting domain name resolution should help mitigate a gateway or proxy (Comcast) from knowing or blocking sites you visit.

DNS is a non-trivial amount of traffic to go moving from a lightweight UDP protocol to something like HTTPS. Furthermore, that would dramatically increase page load times (for reasonably sized pages) since HTTPs requires more turns.

> dramatically increase page load times

This is true, but with a reasonable cache design, it shouldn't be too bad.

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#55

Post by throwaway2016a »

criddell wrote: post #54
swiley wrote: post #22

Earlier quoted context omitted.

DNS is a non-trivial amount of traffic to go moving from a lightweight UDP protocol to something like HTTPS. Furthermore, that would dramatically increase page load times (for reasonably sized pages) since HTTPs requires more turns.

> dramatically increase page load times This is true, but with a reasonable cache design, it shouldn't be too bad.

Unfortunately a single page load often contains files from many different domains. Sometimes 10+. So caching may be of limited use.

Although this may be a nice driving factor to get eCommerce sites to stop putting 50 tracking pixels on every page.

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#56

Post by throwaway2016a »

syncerr wrote: post #5

I'd vote for DNS-over-HTTPS or similar tech. Encrypting domain name resolution should help mitigate a gateway or proxy (Comcast) from knowing or blocking sites you visit.

I always found DNS to be one of the most compelling uses of the blockchain. Namecoin actually did a great job at this.

Effectively if put into practice, ISPs would run name servers that effectively mirror the whole DNS system via blockchain. And if you really wanted to have ultimate privacy you could run it locally on your machine and there would be no way for anyone to know what domains you've looked up.

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#57

Post by throwaway2016a »

SwellJoe wrote: post #6

It's not security related, but: Accessibility.

I second this. Most of the other ideas here are either technologies that don't exist yet or things only nerds care about (I'm a nerd so I can say that).

This would have a meaningful impact on the lives of many in an underserved community.

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#58

Post by linopolus »

swiley wrote: post #24
linopolus wrote: post #20

A ban of everything JS except for these so-called web apps, which obviously need it. Make the internet great (performant/efficient/secure) again!

Really what browsers need are profiles. Maybe a research profile that just supports submitting search forms and renders everything in the same colors and the same fonts and the same margins, and an app profile which lets pages do all the ridiculous JS crap.

And websites supporting this. I recently came across some site providing a paper that wouldn't even load the raw text without JS.

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#60

Post by criddell »

throwaway2016a wrote: post #55
criddell wrote: post #54

Earlier quoted context omitted.

> dramatically increase page load times This is true, but with a reasonable cache design, it shouldn't be too bad.

Unfortunately a single page load often contains files from many different domains. Sometimes 10+. So caching may be of limited use. Although this may be a nice driving factor to get eCommerce sites to stop putting 50 tracking pixels on every page.

That's true. DNS lookups seem like something you can do in parallel though, so I still don't think it's that big of a hit.
Post reply on HN