Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What feature would you want the web to “force” next, after HTTPS?

news.ycombinator.com

Post reply on HN
Print view View original

151–160 of 279 posts

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#151

Post by StavrosK »

normalocity wrote: post #133
StavrosK wrote: post #128

Earlier quoted context omitted.

I was thinking of writing a spec and implementation on a similar thing a few days ago: Each site would publish a standardized file in a standardized location, and/or add a META tag to the file in each page. The file itself would simply contain the URL to the login page and the parameters that should be passed to it, and the way to pass those parameters. Then, your browser/password manager could simply perform a reque…

Unfortunately that requires mass standardization (adopting the spec), which is probably unlikely given that no one standardizes on the registration form to begin with.

Standardizing on the form would be much harder. For Django sites, for example, this would be a one-line change (adding the library to Django), and similarly for Node or Rails or most other frameworks.

The advantage, where password managers would just log you in transparently on any site, would hopefully be big and visible enough for more and more sites to start implementing this.

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#152

Post by bnjemian »

thaumasiotes wrote: post #91
gruez wrote: post #76

Earlier quoted context omitted.

>The discontinuation of using SSL certificates for verification of website identities and a move to true fingerprinting ala SSH. You do realize that's trust-on-first-connect aka self signed certigicates, right? Especially with LE, thats worse in every way to the CA model. >Logins on websites with a public / private keypair ala SSH. Pretty much client certificates minus PKI.

SSH is only trust-on-first-connect if you choose to behave that way. Whenever you connect to a new machine, it prompts you "I don't recognize this machine, and its fingerprint is XXXX. Do you trust that?" I don't see how the option to trust websites is worse than having a bunch of certificate authorities choose who I'll trust for me.

As an individual user, you have no better information than your knowledge of the website and its claims on security, maybe its brand, and what your social circles claim about its security practices. A certificate authority at least has the potential to aggregate data and from there assess the security of a website. The original ideas behind certificate authorities are not dissimilar from insurance.

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#153

Post by mLuby »

frik wrote: post #41

Dear overlord, stop this shit. Don't force any web user over your agenda BS. Amazon.com worked fine from 1995 to 2016 with HTTP (only the login page was HTTPS). If you have a crappy ISP like Verizon or whatever, it's your own personal problem - 99% of the web user don't care about your problem. Maybe use a VPN to somewhere to an ISP you can trust. I stopped using Firefox because they turned mad. Chromium with some cu…

There's often no ISP choice available. https://arstechnica.com/information-technology/2016/08/us-br...

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#154

Post by vacri »

StavrosK wrote: post #142
antjanus wrote: post #88

Earlier quoted context omitted.

SSH-style login is still something I'd really fucking love. Much more secure way of logging in, easy protocol for storing multiple passwords, and easy authorization/deauthirzation of passwords/keys.

Client TLS certs already exist, and they are a massive pain for the average user.

I remember StartCom used client TLS certs, the only place where I ever saw them in use, and the browser workflow was certainly clunky. I'd hate to see a non-techie have to deal with it.

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#155

Post by bnjemian »

freehunter wrote: post #144
frandroid wrote: post #102

Earlier quoted context omitted.

So IE should say "sorry I suck, switch to another browser?" Doesn't make any sense... I mean sites will already tell users they don't support older browsers.

What would really be nice is to have a spec that either you follow or you don't. If you follow it, you follow all of it and it just works. If you don't Javascript is completely broken. It'd be a good incentive to get browser vendors on board.

I like it, not dissimilar from the shaming model that has contributed to HTTPS accelerating adoption.

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#156

Post by vacri »

Sohcahtoa82 wrote: post #140
jchw wrote: post #96

Earlier quoted context omitted.

In theory this is an awesome idea, but it faulters for a couple reasons imo. One is graceful degradation, in case of bugs in a browser, or a browser doesn't support new syntax, etc. If the spec had byte-for-byte specification for what happened when, this would be fine, and of course that is the case for say, JSON, which has remained roughly the same since inception. But given how fast CSS and JS are moving, it would…

> or a browser doesn't support new syntax, Then the user needs to update their browser. It's pretty inexcusable these days to not keep your browser up-to-date, and browsers tend to support new language specs before those specs get widespread usage.

> before those specs get widespread usage.

'widespread'

This would kill off new features, basically. No-one would implement a new feature, because it would kill off their users in $other_browsers completely, and browsers add new features piecemeal - without seeing which features are popular, there's no way to tell what is best bang-for-buck to work on.

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#157

Post by snarf21 »

m-j-fox wrote: post #80
vfulco wrote: post #78

2FA everywhere, preferably with Yubikey (no connection but happy user)

Side question: Do you use your Yubikeys for GPG? I tried to make two identical keys with the same GPG key, but still I get "Please remove the current card and insert the one with serial number: ..." if I try to decrypt a file with the other key. I asked the internet a couple times but no one seems to know.

This is the most important thing. It solves so may other inconveniences of the net. Your username should be your fingerprint. Your password should be 8 characters. You should have a 2fa fob that secures your account. So much less fraud and other attacks. I think this has the highest ROI.
Post reply on HN