Ask HN: What feature would you want the web to “force” next, after HTTPS?

Re:Ask HN: What feature would you want the web to “force” ne... by dredmorbius on Wednesday July 12, 2017 @07:29PM (#14757563)

Signed archives of trusted or untrusted fingerprints, distributed by various and independent authorities is one option.

Trust is, by definition, an extention of solidity or support. CA is a trust model, which has proved both brittle and unworkable.

http://www.etymonline.com/index.php?term=trust&allowed_in_fr...

Google and other services presently provide extended trust and validity assessments for websites: pinned certificates, malware scans, and the like. A limited number of such reliable schemes would scale reasonably well, and should prove useful.

I'm not saying "perfect", I'm saying "useful".

[ Parent | on HN ]

Re:Ask HN: What feature would you want the web to “force” ne... by topranks on Thursday July 13, 2017 @02:34AM (#14759189)

DANE perhaps?

http://www.internetsociety.org/deploy360/resources/dane/

[ Parent | on HN ]

Re:Ask HN: What feature would you want the web to “force” ne... by dredmorbius on Thursday July 13, 2017 @06:01AM (#14760028)

Interesting, that's a possibility.

I was thinking of something more akin to, say Google's pinned certificates (something which practices such as Let's Encrypt actually makes harder AFAICT):

https://security.stackexchange.com/questions/29988/what-is-c...

Or something that might be a parallel of email reputation services -- SenderBase / IronPort (now Cisco) rating email servers by their spam loads, etc.

Rather than negative reputation, a positive reputation (vouch rather than warn) might be viable. (Negative ratings systems, digital or otherwise, tend to inspire various legal assaults.)

[ Parent | on HN ]