231–240 of 279 posts
Start cracking down on bloated and unnecessary JS. Loading more than 1 script? More than X KBs of total JS? More than Y secs CPU time? "This page is slowing down your PC".
That'd be hilarious and tragic. Most of the internet would be flagged slow.
Working version without javascript (unless it's crucial for the website). No opacity 0 animations, javascript only menus etc.
I don't know how this could be implemented though
First party isolation. Social media buttons and other trackers should not get a global identity for free. Explicit opt-in to store persistent state at all. An exception should be a cryptographic identity that is only revealed when you click a login button. No sound without opt-in. No big data transfers without opt-in. If a site wants to shove 10MB of crap in their article, then they should have to show a page asking…
I'm getting closer to dropping Google, but not quite there yet.
It's not security related, but: Accessibility.
Yep, browsers should have screen readers built in. It's ridiculous that you have to shell out $1000+ for a JAWS license (there are alternatives, but they need work).
Earlier quoted context omitted.
You'll have half your users with passwords like '123'. You could say it's the user's fault and their account is compromised, but when it's half the users on your site, really your site is compromised. Better to have a minimum password entropy.
I understood the parent comment as the password length should be 3 digits long (hundreds of chars) rather than password itself.
i.e. No noticeable maximum length for people using password managers and generating 30, 50 or 100 char random passwords, but still insulated against attacks with endless streams of input data - it is acceptable to reject 10 000 char passwords as a hostile input designed to tie up server resources.
I said nothing at all about what the minimum password length should be, and that's deliberate, it's a separate kettle of worms.
But ok: I'm also not a fan of measures such as "password entropy" or "must contain at least one from column A and one from column B". Subjectivity, naive use and changing attacks have given these a bad reputation, often deserved. Password length is not subject to such changing moods.
The parent posts comment, "A decent minimum password length, without any funky requirements, just the minimal length" is fine by me. I didn't want to add to that statement on the topic.
With all the rules in the world, some people are going to have relatively weak passwords, and we cannot entirely eliminate that. But we can also allow and encourage strong passwords by - as an easy first and minimum step - removing deliberate misguided impediments like max lengths and disabling paste.
Earlier quoted context omitted.
- no max length on password at all, or allow a 3 digit number of chars. Never silently truncate passwords either. - never disable paste on a password field.
You'll have half your users with passwords like '123'. You could say it's the user's fault and their account is compromised, but when it's half the users on your site, really your site is compromised. Better to have a minimum password entropy.
I said nothing at all about minimum password lengths, and that's deliberate, it's a separate kettle of worms.
Obtrusive prompt (UAC equivalent) required to load any javascript. How the web would be so much functional, to the point and responsive. Just imagine the electricity savings. The world truly would be a better place.
I couldn't disagree more but there's plenty of browser add-ons that allow you to do this.
Noone will stop using javascript based on what I do locally.
I think this is only really worth the headache for security issues. That said: - HSTS - DNSSEC - IPv6 in that order. I think for a long time, governments had no interest in pushing security and encryption because that would prevent them from mass data collection. I think minds are starting to change around that: poor security is much more likely to be exploited against a government rather than used in its favor (plus…
I feel like I need more training for IPv6. For a long time, I've thought that it was a simple thing to enable and allow (and often our servers are dual stack). It turns out, though, that unless you really know what you're doing on the server side (i.e. overriding the horrible defaults for IPv6 resource allocation), you can end up with an inexplicably slow server that spits out bizarre errors. Anyone here have any rec…
What kind of resource allocation problems did you have on dual-stacked hosts? Windows/Linux/Other??
If its an open standard, mobile-view and other stuff can be progressively added to websites in a variety of ways: built-into browsers, polyfills or open source libraries, and lead to a much better web experience across devices. Aggregator startups and apps would stand to benefit a lot by this.