Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What feature would you want the web to “force” next, after HTTPS?

news.ycombinator.com

Post reply on HN
Print view View original

91–100 of 279 posts

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#91

Post by thaumasiotes »

gruez wrote: post #76
notzorbo3 wrote: post #17

- A protocol for sites to get my public PGP key for server side use - The discontinuation of using SSL certificates for verification of website identities and a move to true fingerprinting ala SSH. - Deprecation of email or rather its insecurity. - Logins on websites with a public / private keypair ala SSH. - A resurgence in sites that let me pick my own anonymous username instead of Facebook, Google or Twitter login…

>The discontinuation of using SSL certificates for verification of website identities and a move to true fingerprinting ala SSH. You do realize that's trust-on-first-connect aka self signed certigicates, right? Especially with LE, thats worse in every way to the CA model. >Logins on websites with a public / private keypair ala SSH. Pretty much client certificates minus PKI.

SSH is only trust-on-first-connect if you choose to behave that way. Whenever you connect to a new machine, it prompts you "I don't recognize this machine, and its fingerprint is XXXX. Do you trust that?"

I don't see how the option to trust websites is worse than having a bunch of certificate authorities choose who I'll trust for me.

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#92

Post by danudey »

paulrosenzweig wrote: post #81
irundebian wrote: post #79

Strict HTML, CSS and JavaScript parsing. One single error => Site won't be displayed. These lazy web devs need some more discipline!

I agree with this, but feel like there might be issues I'm not thinking of. Can anyone shed some light on why browsers are so tolerant today and why that might be a good thing?

The Robustness Principle states "Be conservative in what you do, be liberal in what you accept from others."

Following that maxim, browser developers assumed that, even if HTML wasn't inherently correct, if they could figure out what the user logically meant then assuming that was better than not working at all.

In short, people wrote garbage HTML and it proved easier to fix browsers than people. At first, it wasn't too problematic, but as HTML got more complex more problems surfaced and now everything is a mess.

This was the goal of XHTML: HTML that was required to validate as XML or it wouldn't work at all, and some browsers were, indeed, strict at this. The idea was that you'd only use XHTML if you were generating it with an XML parser or some other template generator that could produce valid code. In reality, that just meant that browsers that didn't understand XHTML treated it like HTML and worked, and browsers that did understand XHTML and validated it would show errors. Thus, users saw that browser X (doing the right thing) couldn't display a site, but browser Y (doing the wrong thing) could.

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#93

Post by cgb223 »

age_bronze wrote: post #89

Registration forms should be standardized. I want to have my "real" details, and my "fake" details ready to be entered into websites that want yet another registration. Why does every single website implement their own registration form with exactly the same details?! Why does every single web site re-implement the registration page slightly differently?! Ideally, I'd enter the registration page, the browser would li…

This sounds like a great opportunity for a startup to create and capitalize on

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#94

Post by raverbashing »

swiley wrote: post #22
syncerr wrote: post #5

I'd vote for DNS-over-HTTPS or similar tech. Encrypting domain name resolution should help mitigate a gateway or proxy (Comcast) from knowing or blocking sites you visit.

DNS is a non-trivial amount of traffic to go moving from a lightweight UDP protocol to something like HTTPS. Furthermore, that would dramatically increase page load times (for reasonably sized pages) since HTTPs requires more turns.

No need to go full https with it, dh once per session, then exchange data (could be over udp)

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#95

Post by cgb223 »

5ilv3r wrote: post #82

I want a way to force sites to become static after they are rendered. Just frozen, as though they were on paper. I am tired of scrolling making menu bars move around or triggering popovers. Just give me a way to turn off javascript and any dynamic CSS junk after X amount of time. I looked into writing this as a firefox browser extension, but extensions now use javascript so we're all screwed.

Its not perfect, but try reader view on Safari.

I use it alot to make various articles and blog posts more readable.

There's also quite a few reader view plugins for Chrome, Firefox, etc

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#96

Post by jchw »

irundebian wrote: post #79

Strict HTML, CSS and JavaScript parsing. One single error => Site won't be displayed. These lazy web devs need some more discipline!

In theory this is an awesome idea, but it faulters for a couple reasons imo. One is graceful degradation, in case of bugs in a browser, or a browser doesn't support new syntax, etc.

If the spec had byte-for-byte specification for what happened when, this would be fine, and of course that is the case for say, JSON, which has remained roughly the same since inception. But given how fast CSS and JS are moving, it would be painful to do this same thing with either of those.

XHTML did this with HTML, but it kind of sucked because some browsers would reject what others would accept in some edge cases, and that is terrible. Plus, there's already a lot of bad HTML in the wild and XHTML casted some doubt on our ability to maintain a major HTML compatibility break.

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#97

Post by catshirt »

cgb223 wrote: post #93
age_bronze wrote: post #89

Registration forms should be standardized. I want to have my "real" details, and my "fake" details ready to be entered into websites that want yet another registration. Why does every single website implement their own registration form with exactly the same details?! Why does every single web site re-implement the registration page slightly differently?! Ideally, I'd enter the registration page, the browser would li…

This sounds like a great opportunity for a startup to create and capitalize on

it's kinda been tried by proxy through authentication standards like OpenID.

i wonder if the solution isn't to back off a little though. that is, standardize some process instead of (de?)centralizing authentication. something that gives developers more control, and users more familiarity, than OpenID.

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#98

Post by O1111OOO »

Disclaimer on all sites about data collection (on sites that collect data):

Precisely what data is collected, a list of the 3rd-parties the data is sent to, the policies of those 3rd-party sites, how long the data is held at the primary domain, how long the data is held at the 3rd-party sites, options for requesting that such data be deleted.

Sites that act as a conduit for the collection and transmission of user data should be held accountable for the breach of such data.

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#99

Post by Felz »

5ilv3r wrote: post #82

I want a way to force sites to become static after they are rendered. Just frozen, as though they were on paper. I am tired of scrolling making menu bars move around or triggering popovers. Just give me a way to turn off javascript and any dynamic CSS junk after X amount of time. I looked into writing this as a firefox browser extension, but extensions now use javascript so we're all screwed.

You can effectively disable JavaScript with WebExtensions by injecting a script that overwrites all the properties of the document and window with undefined. Instantly crashes pretty much any script. If you want to do it sometime after page load, you could replace all those properties with a Proxy object instead, and have that object start throwing errors for any access after X time has passed.

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#100

Post by kyledrake »

Ability to mark HTTPS site as "not secure" using HTTP headers if it's asking for things like logins and passwords.

Would be useful for things like free static HTML web hosts and CDNs for combating phishing.

Could be something put in CSP.

Post reply on HN