The document discusses the inadequacies of current web security practices, particularly regarding the use of URLs with embedded passwords and the need for improved cryptography. It proposes a transition plan for upgrading the web, advocating for collaboration between browser makers and secure sites to enhance security and application development without compromising existing functionalities. The text emphasizes the importance of a decentralized approach to trust management and global uniqueness in identifiers.

1. Upgrading the Web
A Prospectus

2. Apology

3. The Web

4. Security

5. Passwords

6. RFC 1738
December 1994
// user : password @ host : port / url-path
The use of URLs containing passwords
that should be secret is clearly unwise.

7. What’s wrong with the Web?

8. What’s wrong with the Web?
Insecure
Complex

9. HTTP
Key : value pairs
Negotiation
Request/response protocol

10. DNS

11. SSL

12. Certi cate Authorities

13. HTML

14. Templating

15. Document Object Model

16. CSS

17. JavaScript

18. Many Have Tried
• Microsoft, Apple, Adobe, Oracle, many more.
• In most cases, the technology was much better.
• In most cases, the solution was not open.
• There was no transition.

19. Upgrade the Web.
Keep the things it does well.

20. HDTV

21. Helper App

22. Transition Plan
• Convince one progressive browser maker to integrate.
• Convince one secure site to require its customers to
use that browser.
• Risk mitigation will compel the other secure sites.
• Competitive pressure will move the other browser
makers.
• The world will follow for improved security and faster
application development.
• Nothing breaks!

23. Strong Cryptography
• ECC 521
• AES 256
• SHA 3-256

24. Zooko’s Triangle
Human
Meaningful
Securely
Unique
Global:
Decentralized

25. ECC521 public keys as unique
identifiers

26. Secure JSON over TCP

27. web: publickey @ ipaddress / capability

28. Trust Management
Petnames

29. Vat

30. Cooperation under mutual suspicion.

31. JavaScript
Message
Server
Qt

32. The Old Web: Promiscuity
The New Web: Commitment

33. There’s nothing new here.

34. In the meantime,
keep doing what you’re doing.

35. Hope

36. KEEP
CALM
AND
JS
ON