Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What feature would you want the web to “force” next, after HTTPS?

news.ycombinator.com

Post reply on HN
Print view View original

111–120 of 279 posts

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#111

Post by chii »

catshirt wrote: post #97
cgb223 wrote: post #93

Earlier quoted context omitted.

This sounds like a great opportunity for a startup to create and capitalize on

it's kinda been tried by proxy through authentication standards like OpenID. i wonder if the solution isn't to back off a little though. that is, standardize some process instead of (de?)centralizing authentication. something that gives developers more control, and users more familiarity, than OpenID.

open ID moves the user away from your service, which i think is not what some sites want because they want more user info and control. that's why openid failed.

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#112

Post by mabcat »

5ilv3r wrote: post #82

I want a way to force sites to become static after they are rendered. Just frozen, as though they were on paper. I am tired of scrolling making menu bars move around or triggering popovers. Just give me a way to turn off javascript and any dynamic CSS junk after X amount of time. I looked into writing this as a firefox browser extension, but extensions now use javascript so we're all screwed.

I've been using this Kill Sticky bookmarklet, and it's turned out to be one of life's simple pleasures. Gets rid of menu bars and popovers. It's the most-used thing on my bookmarks toolbar by a factor of about eleventy babillion. It's not automatic like an extension would be, but you'll find you get 80% of what you want with a tiny bookmarklet.

https://alisdair.mcdiarmid.org/kill-sticky-headers/

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#114

Post by dredmorbius »

conorgil145 wrote: post #101
thaumasiotes wrote: post #91

Earlier quoted context omitted.

SSH is only trust-on-first-connect if you choose to behave that way. Whenever you connect to a new machine, it prompts you "I don't recognize this machine, and its fingerprint is XXXX. Do you trust that?" I don't see how the option to trust websites is worse than having a bunch of certificate authorities choose who I'll trust for me.

How would you possibly know which fingerprints to trust? Also, do you honestly think there is any hope for the average user to understand what that means and know what to trust and what not to trust? IMO, that is a massive step backwards in usability, which directly impacts the overall security of a given solution. If something is not usable, then people will figure out a way around it and security then goes out the…

Signed archives of trusted or untrusted fingerprints, distributed by various and independent authorities is one option.

Trust is, by definition, an extention of solidity or support. CA is a trust model, which has proved both brittle and unworkable.

http://www.etymonline.com/index.php?term=trust&allowed_in_fr...

Google and other services presently provide extended trust and validity assessments for websites: pinned certificates, malware scans, and the like. A limited number of such reliable schemes would scale reasonably well, and should prove useful.

I'm not saying "perfect", I'm saying "useful".

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#115

Post by dredmorbius »

criddell wrote: post #51
notzorbo3 wrote: post #17

- A protocol for sites to get my public PGP key for server side use - The discontinuation of using SSL certificates for verification of website identities and a move to true fingerprinting ala SSH. - Deprecation of email or rather its insecurity. - Logins on websites with a public / private keypair ala SSH. - A resurgence in sites that let me pick my own anonymous username instead of Facebook, Google or Twitter login…

I love the encryption ideas. Do you know if PGP public/private key pairs can be used for ephemeral keys? I'd hate to rely on the same secret to store everything throughout time.

PGP allows creation of subkeys. I'm not entirely clear that that's useful here, but it might be.

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#116

Post by sabujp »

age_bronze wrote: post #89

Registration forms should be standardized. I want to have my "real" details, and my "fake" details ready to be entered into websites that want yet another registration. Why does every single website implement their own registration form with exactly the same details?! Why does every single web site re-implement the registration page slightly differently?! Ideally, I'd enter the registration page, the browser would li…

chrome already has variants of my information cached for forms

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#117

Post by eastbayjake »

age_bronze wrote: post #89

Registration forms should be standardized. I want to have my "real" details, and my "fake" details ready to be entered into websites that want yet another registration. Why does every single website implement their own registration form with exactly the same details?! Why does every single web site re-implement the registration page slightly differently?! Ideally, I'd enter the registration page, the browser would li…

> Why does every single web site re-implement the registration page slightly differently?!

Because registration pages are the top of most sites' conversion funnels, and as such they produce metrics that reflect on not just IT teams but also UX/design and marketing. The amount of tinkering and customization in registration pages is a political/organizational problem, not a UI/tech problem.

And besides that, no business has an incentive to make it easier for you to free-ride their service with fake credentials. The better question might be why so many companies continue to put cost-inducing barriers like signup in their flow before they fully demonstrate the value-creating potential of their product. I liked Facebook's "Anonymous Login" but apparently very few developers were actually interested.

https://www.recode.net/2015/3/6/11559878/whatever-happened-t...

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#118

Post by dredmorbius »

Standardise on a set of basic document types. Index page, article, gallery, search/results. Others as necessary. Specify standard elements and styling.

Standardised metadata. Pages should have title, author, publication date, modification date, publisher, at a minimum. Some form of integrity check (hash, checksum, tuple-based constructs, ...).

User-specified page styling. If I can load a page in Reader Mode, https://outline.com, or Pocket, I will (generally in that order). Every page having some stupid different layout or styling is a bug, not a feature. Web design isn't the solution, Web design is the problem. Users could specify their default / preferred styling. Night mode, reader support, etc., as standards.

Fix authentication. PKI or a 2FA based on a worn identification element (NFC in a signet ring with on-device sensor is my personal preference), if at all possible. One-time / anon / throwaway support.

Reputation associated with publishers and authors. Automated deprecation of shitposting users, authors, sites, companies.

Discussion threads as a fundamental HTML concept.

Dynamic tables: Sort, filter, format, collapse fields, in client. Charting/ploting data would be another plus.

Native formula support.

Persistent local caching. Search support.

Replace tabs with something that works, and supports tasks / projects / workflows. (Tree-style tabs is a concept which leans this way, though only partially).

Fix-on-reciept. Lock pages down so that they are no longer dynamic and can simply be referred to as documents. Save to local storage and recall from that to minimise browser memory and CPU load.

Export all A/V management to an independent queueing and playback system.

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#119

Post by joegosse »

kerkeslager wrote: post #72
momania wrote: post #66

- A decent minimum password length, without any funky requirements, just the minimal length. - Being able to prosecute any company that stores passwords in plain text

I think the only way this can happen is zero-knowledge password proofs, i.e. browsers implement a mechanism by which password fields submit a proof that the user has the password, rather than submitting the password. This way the server can only verify the password if they've implemented the proof system correctly, and they can't leak the password because they've never had it. The basic idea is, the server gives a un…

I love the idea of zero-knowledge password proofs. Others can chime in on the approach you've proposed, but I have a more practical concern about developing critical mass.

How do you break through the chicken and egg problem of not enough users using or not enough browsers supporting this capability?

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#120

Post by dredmorbius »

swiley wrote: post #45
davimack wrote: post #42

A truly obfuscatory browser: one in which everything sent to the server looked the same, regardless of which user, region, etc.

curl -H "" -o stuff.html && elinks stuff.html I've been looking for a site I can run this on over TOR at random times for reading news but I haven't found one.

Can elinks read from stdin?
Post reply on HN