Saturday, December 17, 2005

Why no secure Blogger login?

How come Blogger doesn't have a secure (https) login page?

Update: It does, but there's no visible link to it from the main or sign-in page. To make signing in use https, manually convert the protocol to https in the url of the sign-in page.

Saturday, December 03, 2005

"badness" indicator more important than phishing alerts

There's been interest in having browsers display a phishing warning. What would be more useful is if browsers displayed a badness warning, especially before the user followed a link.

"Be careful where you browse". That's popular advice, but how does someone know what the bad parts of the web are? It would be useful if the browser itself gave some clue, e.g. a "bad" link could be in a different color, or the browser prompted the user before displaying/processing the contents of the risky link.

The browser could consult a database of "bad" links, preferably a database that is updated frequently to catch problems like "good" sites being hijacked or newly created "bad" sites.
Browsers could also preprocess the content of the link to gauge it's safety. Of course that means browsers would have to have a mechanism of checking safety that doesn't cause them to do "bad" things.