Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What feature would you want the web to “force” next, after HTTPS?

news.ycombinator.com

Post reply on HN
Print view View original

101–110 of 279 posts

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#101

Post by conorgil145 »

thaumasiotes wrote: post #91
gruez wrote: post #76

Earlier quoted context omitted.

>The discontinuation of using SSL certificates for verification of website identities and a move to true fingerprinting ala SSH. You do realize that's trust-on-first-connect aka self signed certigicates, right? Especially with LE, thats worse in every way to the CA model. >Logins on websites with a public / private keypair ala SSH. Pretty much client certificates minus PKI.

SSH is only trust-on-first-connect if you choose to behave that way. Whenever you connect to a new machine, it prompts you "I don't recognize this machine, and its fingerprint is XXXX. Do you trust that?" I don't see how the option to trust websites is worse than having a bunch of certificate authorities choose who I'll trust for me.

How would you possibly know which fingerprints to trust? Also, do you honestly think there is any hope for the average user to understand what that means and know what to trust and what not to trust? IMO, that is a massive step backwards in usability, which directly impacts the overall security of a given solution. If something is not usable, then people will figure out a way around it and security then goes out the window.

For example, if users were responsible for knowing which fingerprints to trust for a given website, they would most likely just click "ok, trust it" for everything. Then, you're overall security goes way down because now people are conditioned to click "accept" to everything, regardless of the impact.

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#102

Post by frandroid »

payne92 wrote: post #75

Hard deprecation of the long tail of Javascript browser capabilities and incompatibilities. So much code and so many libraries are littered with "if (old version browser) do x, else if IE, do y, else, ..."

So IE should say "sorry I suck, switch to another browser?" Doesn't make any sense...

I mean sites will already tell users they don't support older browsers.

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#104

Post by dane-pgp »

sofaofthedamned wrote: post #7
bmh_ca wrote: post #4

Automated HSTS, revokable public key pins, and certificate transparency.

Agreed, but I'd add ipv6

Agreed, but to those 4 things I'd add DANE TLSA (RFC 6698) and Certification Authority Authorization (CAA) (RFC 6844) as further lines of defence against rogue CAs.

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#108

Post by dmitrygr »

netcraft wrote: post #68
linopolus wrote: post #20

A ban of everything JS except for these so-called web apps, which obviously need it. Make the internet great (performant/efficient/secure) again!

Forgive me, but I just don't understand this sentiment at all. I understand your general frustration with over-engineered websites - but is it not your choice to visit that website? Do you not also have the ability to block javascript just like the scourge of flash websites before it? We aren't talking about vulnerabilities here though, youre just saying that there are websites out there that could do with less (or n…

  Maybe im missing something
You definitely are. Disable js and try browsing. Note the quadrupled battery life in your laptop.

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#109

Post by ryan-allen »

r1ch wrote: post #107

Start cracking down on bloated and unnecessary JS. Loading more than 1 script? More than X KBs of total JS? More than Y secs CPU time? "This page is slowing down your PC".

That'd be hilarious and tragic. Most of the internet would be flagged slow.
Post reply on HN