Live data from Hacker News

Ask HN: What feature would you want the web to “force” next, after HTTPS?

news.ycombinator.com

261–270 of 279 posts

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#261
post #246
post #213

Earlier quoted context omitted.

I like this idea, but because websites have the content, they can simply throw up a button that requests showing your identity to view the content and most people would blindly click it leading to the same situation we have now. The HTTPS push is important and works because the search engines can leverage their importance and the browsers can (effectively) scare people without any user input.

It would just be another case like the EU cookies thing. Every website would have the button and everyone would click it immediately to get rid of it. It would just be an annoyance.

If done well, the chrome would be more clever than that. There should be "log in as [username]" and "stay anonymous". Unless websites want to start validating email addresses to let you read their content, they'll have to accept "stay anonymous" because it would be indistinguishable on the server's end from getting a brand-new user.

So you'd have an idiotic banner pissing off your users and the considerable majority would click "stay anonymous", gaining the site operator nothing.

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#262
post #254

Earlier quoted context omitted.

Forgive me, but I just don't understand this sentiment at all. I understand your general frustration with over-engineered websites - but is it not your choice to visit that website? Do you not also have the ability to block javascript just like the scourge of flash websites before it? We aren't talking about vulnerabilities here though, youre just saying that there are websites out there that could do with less (or n…

>Let me ask it a different way - do you have any reasonable expectation that your proposal will ever be accepted? There are hundreds of pie in the sky suggestions being floated here, and the one about javascript is the one you choose to attack with this argument? JavaScript has unequivocally made the web worse for everyone but advertisers and perhaps the people that run CDNs. Why, of all the proposals here, are you t…

> JavaScript has unequivocally made the web worse for everyone but advertisers and perhaps the people that run CDNs.

Do you really think this is defensible? That the web would be as popular or useful as it is today without the ability to run code in the browser? I'm curious if you think there is a majority of people that agree with this?

> Why, of all the proposals here, are you trying to shit on this one on particular?

I am not shitting on anyone - im trying to have an honest discussion about why you and the OP feel that javascript is such a scourge that it needs to be regulated. Not one person has addressed even one of my questions, you included. I'm sorry you're taking my challenge as hostility - its not intended that way.

I submit that its possible I am missing something - perhaps there is situations out there that I don't have to deal with. I'm asking for an honest view point that I can try to understand.

> ... pie in the sky ...

Theres a difference between "here's something thats easily accepted is a good idea but might be difficult to implement" and this. I'm asking for an explanation of the premise itself.

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#263
post #127

SSL was forced by Google single-handedly. Developers scared that https might provide ranking factor, quickly moved to SSL. As for topic, I would like to see all mails clients rendering emails same god damn way.

And handling replies the same way. Far too often I see someone using IBM Notes send an email to someone using Outlook and when it gets to me the sender says "review the email chain below" and every damn line has another damn angle bracket. Not sure which client is adding it all in, but it makes it unreadable. >hello >>my name is bill >>>i'd like to have a meeting >>>>please provide your availability

>>>>Even worse, is when you have a really long line followed by a

>short

>>>>line that got moved because a word exceeded some unknown column

>boundary.

>>>>This isn't cool anymore, and anyone that implements it should be

>shot.

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#264
post #226
post #224

Earlier quoted context omitted.

Curiously half of what you're describing has already existed on the web for more than 20 years, in the form of server side push using the obscure `multipart/mixed` HTTP content type [1]. This technology was added to Netscape in 1995 and I believe it's still supported by modern browsers, but it seems to have hardly gotten much traction beyond those early webcam sites that an image every N seconds. I am not sure if int…

Wow! They got a x-mixed-replace. That's totally it. From quick googling - looks like it is not working for html since chrome 36 Edit: It works only with svg and only in Firefox, or am I doing something wrong?

Guess I was wrong about the support still being there. I think because nobody used it they must have taken out a lot of that functionality.

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#265

Earlier quoted context omitted.

I think the only way this can happen is zero-knowledge password proofs, i.e. browsers implement a mechanism by which password fields submit a proof that the user has the password, rather than submitting the password. This way the server can only verify the password if they've implemented the proof system correctly, and they can't leak the password because they've never had it. The basic idea is, the server gives a un…

I'm waiting for other people to tell you to implement this, but without JavaScript.

Implementing it in Javascript would defeat the entire purpose. The point is for the browser to implement it as a supported field on input tags of type password.

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#266
post #254

Earlier quoted context omitted.

>Let me ask it a different way - do you have any reasonable expectation that your proposal will ever be accepted? There are hundreds of pie in the sky suggestions being floated here, and the one about javascript is the one you choose to attack with this argument? JavaScript has unequivocally made the web worse for everyone but advertisers and perhaps the people that run CDNs. Why, of all the proposals here, are you t…

> JavaScript has unequivocally made the web worse for everyone but advertisers and perhaps the people that run CDNs. Do you really think this is defensible? That the web would be as popular or useful as it is today without the ability to run code in the browser? I'm curious if you think there is a majority of people that agree with this? > Why, of all the proposals here, are you trying to shit on this one on particul…

Plenty of popular web applications work(ed) without JavaScript. I'm thinking here of thinks like Gmail.

The only thing that I can think of that absolutely requires JavaScript is advertising and tracking.

Anything else better serves the user as a desktop or native app.

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#267

Earlier quoted context omitted.

I think the only way this can happen is zero-knowledge password proofs, i.e. browsers implement a mechanism by which password fields submit a proof that the user has the password, rather than submitting the password. This way the server can only verify the password if they've implemented the proof system correctly, and they can't leak the password because they've never had it. The basic idea is, the server gives a un…

I love the idea of zero-knowledge password proofs. Others can chime in on the approach you've proposed, but I have a more practical concern about developing critical mass. How do you break through the chicken and egg problem of not enough users using or not enough browsers supporting this capability?

If it's a field on inputs of type password, all you'd get is something like:

Browsers that support the password-nonce argument sign as I described. Browsers that don't support it pass through the password and the server performs the ZKPP key generation (this is no worse than the current system of hashing passwords). So servers can implement this immediately without worrying about breaking in non-supporting browsers.

After adoption by a few major sites, browsers can add a warning that the server didn't send a password nonce and the password will be passed to the server so the user has to click "Okay" before it gets submitted. This can be escalated to more severe messages to pressure more sites to comply.

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#268
post #163

Add SRV lookups to the HTTP standard. There's a tremendous amount of complexity and cost attached to the fact that browsers look up the IP address of the hostname and then connect to port 80. First, it's true that you can specify another port in the URL, but nobody does that because it's ugly and hard to remember. If you want to be able to send people to your website, you need to be able to tell people what the url i…

Lots of people are pointing out that with the Host header one web server can handle multiple domains. Yes, that's true.

It's be useful in cases where you have one organization that hosts multiple domains. Then you just configure your server to handle this domain this way, and that domain that way, etc.

But it doesn't help the cases where you want to host multiple, unrelated websites on one server. Let's say Acme Widgets has a static site that just serves files off the filesystem, but they've got a bunch of rewrite rules to handle legacy urls. Umbrella corp wants to run a node backend. To get that to work, you need to agree on a server that will handle the requests. Everybody needs to be able to configure it to their liking, which leads quickly to the cPanel scenario I mentioned above. Or, hey, we can automatically configure the shared server as a proxy and let everybody run their own servers on non-privileged ports! That works, but it introduces unnecessary overhead in terms of memory, CPU, SPOF, latency, configuration etc. It would be better to just have the browser connect directly to those unprivileged ports!

tptacek brings up the good point that lots of networks block connections on ports other than 80 and 443. That's true, but it's because of the fact that HTTP essentially has to use those ports. If the web started working on other ports, that would change. Slowly, yes. Port 80 would have a special status for a long time. But if the standards did support other ports, network administrators would have a hard time answering "Why can't I connect to acme.com?" with anything other than "oops, let me fix that". This would be a way easier transition than say, switching to IPv6.

Finally, I'll reiterate that none of these problems are insurmountable. The web exists because we've found ways to work around them. A lot of use make a living doing just that. But that doesn't mean this is the best way of doing things, or that the work-arounds have no cost.

Re: Ask HN: What feature would you want the web to “force” next, after HTTPS?

#270

- Make client-side certificate authentication mainstream. Fix the UI, UX - Standardize on some sort of biometric identification that actually works. I HATE two-factor :(

1. Client-side certificates usage has privacy implications - https://github.com/tumi8/cca-privacy 2. Is biometric really necessary? U2F tokens already exist and are standardized (maybe not officially, I'm not sure). Chrome and Opera already support it, Mozilla's support must be coming soon (meanwhile you can use an add-on).

I am sick of the actual motions of authenticating, and many of the 2-factor implementations out there today are terrible. (SMS, really? What happens when your phone is stolen? How do you protect against an angry lover? What a joke)

U2F dongles aren't much better.

Also, a quick glance at that link seems to indicate attacker needs some sort of MITM access? Is it anything more than a replay attack?

Post reply on HN