Erik van Straten<p><span class="h-card" translate="no"><a href="https://troet.cafe/@rohare" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>rohare</span></a></span> : thank you! Of course the feature list could be expanded, but many things can also be implemented using browser extensions / plug-ins.</p><p>IMO implementing my proposal using extrensions will not work, because we need a revolution, all combined:</p><p>1) Trustworthy certificates containing *human readable* (+) information identifying the responsible entity for "risky" websites (DV is fine for your home-NAS because you *know* when a given domain name is *not* yours);</p><p>2) Browsers showing that information upon first visit (using that browser, optionally synced cross devices) or when anything changes (website owner in particular);</p><p>3) User education. Browsers should contain or point to easy to understand tutorials.</p><p>Again, full details in <a href="https://infosec.exchange/@ErikvanStraten/113079966331873386" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">infosec.exchange/@ErikvanStrat</span><span class="invisible">en/113079966331873386</span></a>.</p><p>(+) The cert that Chrome on Android shows for <a href="https://stripe.com" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">stripe.com</span><span class="invisible"></span></a> is NOT human readable, and incomplete as well (see <a href="https://crt.sh/?id=17223459392" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">crt.sh/?id=17223459392</span><span class="invisible"></span></a>).</p><p>NOTE: Apart from the domain name "stripe.com", the only additional identifying information in the cert below is the name of the organization: "Stripe, inc". The information that is *NOT* shown is *EXACTLY* the reason why Google killed EV (and OV) certificates, assisted by (notably) Troy Hunt: <a href="https://www.troyhunt.com/extended-validation-certificates-are-really-really-dead/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">troyhunt.com/extended-validati</span><span class="invisible">on-certificates-are-really-really-dead/</span></a>.</p><p><span class="h-card" translate="no"><a href="https://infosec.exchange/@haveibeenpwned" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>haveibeenpwned</span></a></span> </p><p><a href="https://infosec.exchange/tags/Certificates" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Certificates</span></a> <a href="https://infosec.exchange/tags/Browsers" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Browsers</span></a> <a href="https://infosec.exchange/tags/Education" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Education</span></a></p>