this post was submitted on 14 Oct 2026
132 points (75.0% liked)
Privacy
51480 readers
275 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
founded 7 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Imagine if HTTP explicitly documented as part of the standard that the "User-Agent" header, when provided, must include a tamper-proof cryptographic signature that allows to securely identify which browser version the user has (with a consortium maintaining a list of registered browsers) so that websites can reject access if you are not using a browser they trust or they don't like that your browser is too old...
Considering how much abuse there has been with the User-Agent header... I can't imagine it being a good idea to include such a thing in the standard.
If on creation HTTP had included things like that, then I think Gopher and other competitors at the time might not have been a bad option, honestly.
I don't see your point I'm sorry. This would make it easier for Google to exclude small competitors.
The point is that not all protocols are created equal. So "we shouldn’t have created HTTP" depends on what HTTP is specifying.
If a protocol makes it easier for big players to abuse the system, then it's a worse protocol in that respect.
The point being made against passkeys is that, in some respects, it's worse because of the inclusion of attestation as part of the standard. You could, theoretically, have an alternative protocol to passkeys that does not officially endorse attestation.